jmri: remove one-shot xpra migration task (idempotency fix)

Migration from Ubuntu 3.x to upstream 6.x is complete. The explicit
removal task was firing changed on every run. state: latest on the
install task handles upgrades going forward.

.gitignore

@@ -1,15 +1,9 @@
-# macOS system files
+# macOS
 .DS_Store
 .AppleDouble
 .LSOverride
-
-# Icon must end with two \r
 Icon
-
-# Thumbnails
 ._*
-
-# Files that might appear in the root of a volume
 .DocumentRevisions-V100
 .fseventsd
 .Spotlight-V100
@@ -17,36 +11,53 @@ Icon
 .Trashes
 .VolumeIcon.icns
 .com.apple.timemachine.donotpresent
-
-# Directories potentially created on remote AFP share
 .AppleDB
 .AppleDesktop
 Network Trash Folder
 Temporary Items
 .apdisk
-
-# VS Code
-.vscode/
-
-# macOS metadata
 *.icloud
 
-# Terraform
-terraform/
+# IDE
+.vscode/
+.idea/
+.kiro/
+
+# Terraform (track .tf files, ignore state and runtime)
 .terraform/
 *.tfstate
 *.tfstate.backup
-
-# Crash log files
+# *.tfvars
+!*.tfvars.example
+!*.pkrvars.hcl
 crash.log
-
-# Ignore override files as they are usually used to override resources locally
 *.override.tf
 *.override.tf.json
-
-# Ignore CLI configuration files
 .terraformrc
-.terraformrc.json
+terraform.rc
 
-# Ignore secrets
-doppler-token.yaml
+# Ansible
+*.retry
+ansible/vault/*.vault
+
+# Packer
+packer_cache/
+
+# Secrets
+*.pem
+*.key
+
+# Environment files with secrets
+boilerplates/**/.env
+
+# Local paths
+~/
+
+# Misc
+doppler-token.yaml
+
+# talhelper generated machine configs — contain secrets, never commit
+talos/talhelper/clusterconfig/
+# talenv.yaml plaintext — only commit the SOPS-encrypted version
+talos/talhelper/talenv.yaml
+!talos/talhelper/talenv.sops.yaml

.kiro/specs/applescript-calendar-sync/design.md

@@ -1,209 +0,0 @@
-# Design Document
-
-## Overview
-
-The AppleScript Calendar Sync system is designed as a standalone AppleScript application that synchronizes calendar events between two calendar accounts for the current day only. The system uses macOS Calendar app's AppleScript interface to read events from a source calendar and mirror them to a destination calendar, including removal of events that no longer exist in the source.
-
-## Architecture
-
-The system follows a simple pipeline architecture:
-
-```
-[Source Calendar] → [Event Reader] → [Event Processor] → [Destination Calendar]
-                                          ↓
-                                   [Duplicate Detector]
-                                          ↓
-                                   [Cleanup Manager]
-```
-
-### Core Components
-
-1. **Calendar Manager**: Handles calendar account and calendar selection/validation
-2. **Event Reader**: Retrieves events from source calendar for current day
-3. **Event Processor**: Processes and transforms events for destination calendar
-4. **Sync Engine**: Coordinates the synchronization process including cleanup
-5. **Logger**: Provides user feedback and error reporting
-
-## Components and Interfaces
-
-### Calendar Manager
-```applescript
--- Validates and retrieves calendar references
-on getCalendar(accountName, calendarName)
-on validateCalendarAccess(calendar)
-on listAvailableCalendars()
-```
-
-**Responsibilities:**
-- Validate calendar account and calendar names exist
-- Return calendar object references for AppleScript operations
-- Handle calendar access permissions and errors
-
-### Event Reader
-```applescript
--- Reads events from source calendar for current day
-on getEventsForToday(sourceCalendar)
-on parseEventProperties(event)
-```
-
-**Responsibilities:**
-- Query source calendar for events occurring on current date
-- Extract event properties (title, start time, end time, description, etc.)
-- Handle different event types (all-day, timed, recurring)
-
-### Event Processor
-```applescript
--- Processes events for destination calendar
-on createEventInDestination(eventData, destinationCalendar)
-on updateExistingEvent(existingEvent, newEventData)
-on compareEvents(event1, event2)
-```
-
-**Responsibilities:**
-- Create new events in destination calendar
-- Update modified events
-- Compare events for duplicate detection
-
-### Sync Engine
-```applescript
--- Main synchronization coordinator
-on performSync(sourceCalendar, destinationCalendar)
-on cleanupRemovedEvents(sourceEvents, destinationEvents, destinationCalendar)
-on generateSyncReport(results)
-```
-
-**Responsibilities:**
-- Coordinate the entire sync process
-- Manage event cleanup (removal of events not in source)
-- Generate sync reports and statistics
-
-### Logger
-```applescript
--- Logging and user feedback
-on logMessage(message, level)
-on displayProgress(current, total)
-on showSyncSummary(summary)
-```
-
-**Responsibilities:**
-- Display progress information to user
-- Log errors and warnings
-- Show final sync summary
-
-## Data Models
-
-### Event Data Structure
-```applescript
-record EventData
-    title: string
-    startDate: date
-    endDate: date
-    isAllDay: boolean
-    description: string
-    location: string
-    uid: string (for duplicate detection)
-end record
-```
-
-### Sync Result Structure
-```applescript
-record SyncResult
-    eventsCreated: integer
-    eventsUpdated: integer
-    eventsRemoved: integer
-    eventsSkipped: integer
-    errors: list of strings
-end record
-```
-
-## Error Handling
-
-### Error Categories
-1. **Calendar Access Errors**: Invalid calendar names, permission issues
-2. **Event Processing Errors**: Malformed events, property access failures
-3. **Sync Operation Errors**: Network issues, calendar service unavailable
-
-### Error Handling Strategy
-- Graceful degradation: Continue processing other events when individual events fail
-- Detailed error logging with specific error messages
-- User-friendly error reporting with suggested solutions
-- Rollback capability for critical failures
-
-### Error Recovery
-```applescript
-on handleCalendarError(errorMessage)
-    -- Log error details
-    -- Provide user-friendly error message
-    -- Suggest corrective actions
-end handleCalendarError
-```
-
-## Testing Strategy
-
-### Unit Testing Approach
-Since AppleScript has limited testing frameworks, testing will focus on:
-
-1. **Manual Testing Scenarios**:
-   - Test with empty source calendar
-   - Test with events spanning multiple days
-   - Test with all-day events
-   - Test with recurring events
-   - Test calendar access errors
-
-2. **Integration Testing**:
-   - Test full sync workflow with real calendar data
-   - Test cleanup functionality (event removal)
-   - Test duplicate detection accuracy
-   - Test error handling with invalid inputs
-
-3. **Edge Case Testing**:
-   - Very long event titles and descriptions
-   - Events with special characters
-   - Overlapping events
-   - Events created/modified during sync
-
-### Test Data Requirements
-- Test calendars with known event sets
-- Events with various properties (all-day, timed, recurring)
-- Events with special characters and long descriptions
-- Calendar accounts with different permission levels
-
-## Implementation Considerations
-
-### AppleScript Calendar Integration
-- Use `Calendar` application's AppleScript dictionary
-- Handle calendar app launch and focus management
-- Manage calendar selection and event creation timing
-
-### Performance Optimization
-- Batch event operations where possible
-- Minimize calendar app UI interactions
-- Cache calendar references to avoid repeated lookups
-
-### User Experience
-- Provide clear progress indicators
-- Show meaningful error messages
-- Allow user to cancel long-running operations
-- Display comprehensive sync results
-
-### Security and Privacy
-- Request calendar access permissions appropriately
-- Handle sensitive calendar data securely
-- Provide clear information about what data is accessed
-
-## Configuration Management
-
-### User Configuration
-```applescript
--- Configuration properties
-property sourceAccountName : "Work Account"
-property sourceCalendarName : "Main Calendar"
-property destinationAccountName : "Personal Account"
-property destinationCalendarName : "Synced Events"
-property enableLogging : true
-```
-
-### Runtime Configuration
-- Allow users to modify calendar names without editing script
-- Provide configuration validation before sync starts
-- Save user preferences for repeated use

.kiro/specs/applescript-calendar-sync/requirements.md

@@ -1,73 +0,0 @@
-# Requirements Document
-
-## Introduction
-
-This feature enables automatic synchronization of calendar entries between two different calendar accounts using AppleScript. The system will copy events from a source calendar account to a destination calendar account, maintaining event details while avoiding duplicates and providing configurable sync options.
-
-## Requirements
-
-### Requirement 1
-
-**User Story:** As a user with multiple calendar accounts, I want to sync events from one account to another, so that I can maintain consistent scheduling across different calendar systems.
-
-#### Acceptance Criteria
-
-1. WHEN the sync script is executed THEN the system SHALL read all events from the specified source calendar
-2. WHEN events are found in the source calendar THEN the system SHALL copy them to the specified destination calendar
-3. WHEN copying events THEN the system SHALL preserve event title, date, time, duration, and description
-4. IF an event already exists in the destination calendar THEN the system SHALL skip creating a duplicate
-
-### Requirement 2
-
-**User Story:** As a user, I want to configure which calendars to sync between, so that I can control the data flow between my accounts.
-
-#### Acceptance Criteria
-
-1. WHEN configuring the sync THEN the system SHALL allow selection of source calendar account and specific calendar
-2. WHEN configuring the sync THEN the system SHALL allow selection of destination calendar account and specific calendar
-3. WHEN invalid calendar names are provided THEN the system SHALL display an error message and exit gracefully
-4. WHEN calendar accounts are not accessible THEN the system SHALL provide clear error messaging
-
-### Requirement 3
-
-**User Story:** As a user, I want the sync to focus on today's events only, so that I maintain current day synchronization without overwhelming the destination calendar.
-
-#### Acceptance Criteria
-
-1. WHEN the sync runs THEN the system SHALL only process events occurring on the current day
-2. WHEN determining current day THEN the system SHALL use the local system date
-3. WHEN events span multiple days THEN the system SHALL include events that start or occur on the current day
-4. WHEN no events exist for the current day THEN the system SHALL complete successfully with appropriate messaging
-
-### Requirement 4
-
-**User Story:** As a user, I want the destination calendar to mirror the source calendar for the current day, so that removed events are also cleaned up automatically.
-
-#### Acceptance Criteria
-
-1. WHEN checking for duplicates THEN the system SHALL compare event title, start date, and start time
-2. WHEN a matching event is found in the destination THEN the system SHALL skip creating the duplicate
-3. WHEN an event exists in the destination but not in the source for the current day THEN the system SHALL remove it from the destination
-4. WHEN an event has been modified in the source THEN the system SHALL update the corresponding event in the destination
-
-### Requirement 5
-
-**User Story:** As a user, I want to see progress and results of the sync operation, so that I can verify the synchronization was successful.
-
-#### Acceptance Criteria
-
-1. WHEN the sync starts THEN the system SHALL display the source and destination calendar information
-2. WHEN processing events THEN the system SHALL show progress indicators for each event processed
-3. WHEN the sync completes THEN the system SHALL display a summary of events copied, skipped, and any errors
-4. WHEN errors occur THEN the system SHALL log detailed error information for troubleshooting
-
-### Requirement 6
-
-**User Story:** As a user, I want the sync to handle different event types and properties, so that all my calendar data is accurately transferred.
-
-#### Acceptance Criteria
-
-1. WHEN syncing events THEN the system SHALL handle all-day events correctly
-2. WHEN syncing events THEN the system SHALL preserve recurring event patterns when possible
-3. WHEN syncing events THEN the system SHALL handle events with attendees and meeting details
-4. WHEN event properties cannot be transferred THEN the system SHALL log which properties were skipped

.kiro/specs/applescript-calendar-sync/tasks.md

@@ -1,125 +0,0 @@
-# Implementation Plan
-
-- [x] 1. Set up project structure and configuration
-  - Create main AppleScript file with basic structure and configuration properties
-  - Define configuration properties for source and destination calendars
-  - Set up logging and error handling framework
-  - _Requirements: 2.1, 2.2, 5.1_
-
-- [ ] 2. Implement Calendar Manager component
-  - [ ] 2.1 Create calendar validation and access functions
-    - Write functions to validate calendar account and calendar names exist
-    - Implement calendar object retrieval with error handling
-    - Create function to list available calendars for debugging
-    - _Requirements: 2.1, 2.2, 2.3, 2.4_
-
-  - [ ]* 2.2 Write unit tests for calendar access
-    - Create test scenarios for invalid calendar names
-    - Test calendar access permission handling
-    - _Requirements: 2.3, 2.4_
-
-- [ ] 3. Implement Event Reader component
-  - [ ] 3.1 Create current day event retrieval function
-    - Write function to get today's date and create date range
-    - Implement event query for current day from source calendar
-    - Handle different event types (all-day, timed events)
-    - _Requirements: 1.1, 3.1, 3.2, 3.3_
-
-  - [ ] 3.2 Implement event property extraction
-    - Create function to extract event title, dates, description, location
-    - Handle event property access errors gracefully
-    - Parse recurring events for current day occurrences
-    - _Requirements: 1.3, 6.1, 6.2, 6.3_
-
-  - [ ]* 3.3 Write tests for event reading functionality
-    - Test event retrieval with various event types
-    - Test property extraction accuracy
-    - _Requirements: 1.1, 1.3_
-
-- [ ] 4. Implement Event Processor component
-  - [ ] 4.1 Create event comparison and duplicate detection
-    - Write function to compare events by title, start date, and start time
-    - Implement duplicate detection logic for existing events
-    - Handle event matching edge cases
-    - _Requirements: 4.1, 4.2_
-
-  - [ ] 4.2 Implement event creation and update functions
-    - Create function to add new events to destination calendar
-    - Implement event update functionality for modified events
-    - Handle event creation errors and property limitations
-    - _Requirements: 1.2, 1.3, 4.4, 6.4_
-
-  - [ ]* 4.3 Write tests for event processing
-    - Test duplicate detection accuracy
-    - Test event creation with various properties
-    - _Requirements: 4.1, 4.2, 4.4_
-
-- [ ] 5. Implement Sync Engine component
-  - [ ] 5.1 Create main synchronization workflow
-    - Implement the main sync function that coordinates all components
-    - Add progress tracking and user feedback during sync
-    - Handle sync workflow errors and recovery
-    - _Requirements: 1.1, 1.2, 5.2, 5.3_
-
-  - [ ] 5.2 Implement cleanup functionality for removed events
-    - Create function to identify events in destination not in source
-    - Implement event removal from destination calendar
-    - Add safety checks to prevent accidental deletions
-    - _Requirements: 4.3_
-
-  - [ ] 5.3 Create sync reporting and statistics
-    - Implement sync result tracking (created, updated, removed, skipped)
-    - Create summary display function with detailed results
-    - Add error reporting and logging
-    - _Requirements: 5.3, 5.4_
-
-  - [ ]* 5.4 Write integration tests for sync engine
-    - Test complete sync workflow with test data
-    - Test cleanup functionality accuracy
-    - Test error handling and recovery
-    - _Requirements: 4.3, 5.3_
-
-- [ ] 6. Implement Logger component
-  - [ ] 6.1 Create logging and progress display functions
-    - Implement message logging with different severity levels
-    - Create progress indicator for sync operations
-    - Add user-friendly error message formatting
-    - _Requirements: 5.1, 5.2, 5.4_
-
-  - [ ] 6.2 Implement sync summary display
-    - Create formatted summary of sync results
-    - Display statistics for events processed
-    - Show any errors or warnings encountered
-    - _Requirements: 5.3, 5.4_
-
-- [ ] 7. Integrate all components and create main script
-  - [ ] 7.1 Wire together all components in main execution flow
-    - Create main script entry point that calls all components
-    - Implement proper error handling and user feedback flow
-    - Add configuration validation before sync starts
-    - _Requirements: 2.3, 2.4, 5.1_
-
-  - [ ] 7.2 Add user interaction and configuration management
-    - Implement user prompts for calendar selection if needed
-    - Add configuration validation and error messaging
-    - Create user-friendly script execution experience
-    - _Requirements: 2.1, 2.2, 2.3, 2.4_
-
-  - [ ]* 7.3 Create comprehensive end-to-end tests
-    - Test complete sync workflow with real calendar data
-    - Test all error scenarios and edge cases
-    - Validate sync accuracy and cleanup functionality
-    - _Requirements: 1.1, 1.2, 4.3, 5.3_
-
-- [ ] 8. Finalize and optimize the script
-  - [ ] 8.1 Add performance optimizations and error recovery
-    - Optimize calendar access and event processing performance
-    - Add robust error recovery and rollback capabilities
-    - Implement proper resource cleanup and calendar app management
-    - _Requirements: 5.4_
-
-  - [ ] 8.2 Create user documentation and usage instructions
-    - Write clear instructions for script configuration and usage
-    - Document calendar permission requirements
-    - Create troubleshooting guide for common issues
-    - _Requirements: 2.3, 2.4, 5.4_

.kiro/specs/fastpass-additional-control-plane/design.md

@@ -1,165 +0,0 @@
-# Design Document
-
-## Overview
-
-The `fastpass-additional-control-plane` Ansible role will enable the deployment of additional control plane nodes to an existing FastPass Kubernetes cluster. This role follows the established patterns from `fastpass-first-control-plane` but focuses on joining nodes to an already initialized cluster rather than initializing a new one. The role ensures high availability by creating redundant master nodes that can handle API requests, scheduling, and cluster management tasks.
-
-The key difference from the first control plane role is that this role will use `kubeadm join` with control plane flags instead of `kubeadm init`, and it will need to retrieve join tokens and certificate keys from the existing cluster.
-
-## Architecture
-
-### Role Structure
-The role will follow the standard Ansible role structure:
-```
-ansible/playbooks/roles/fastpass-additional-control-plane/
-├── defaults/
-│   └── main.yml
-├── tasks/
-│   └── main.yml
-├── handlers/
-│   └── main.yml (if needed)
-└── meta/
-    └── main.yml (if needed)
-```
-
-### Integration Points
-- **DNS Management**: Uses the existing `dns-manager` role for consistent DNS record creation
-- **Kubeconfig Management**: Uses the existing `kubeconfig-manager` role for local kubeconfig setup
-- **Firewall Configuration**: Reuses firewall service definitions from the first control plane role
-- **Cluster Integration**: Coordinates with the first control plane node to obtain join credentials
-
-### Dependencies
-- The first control plane node must be fully initialized and running
-- The `dns-manager` role must be available for DNS record creation
-- The `kubeconfig-manager` role must be available for kubeconfig setup
-- Required Kubernetes prerequisites must be installed on target nodes
-
-## Components and Interfaces
-
-### Main Task Flow
-1. **Pre-flight Checks**: Verify cluster readiness and node prerequisites
-2. **DNS Configuration**: Set up DNS records for the new control plane node
-3. **Firewall Configuration**: Open required ports for control plane services
-4. **Kubelet Configuration**: Create initial kubelet configuration
-5. **Join Token Retrieval**: Get join token and certificate key from first control plane
-6. **Cluster Join**: Execute kubeadm join with control plane flags
-7. **Service Management**: Ensure kubelet is enabled and running
-8. **Kubeconfig Setup**: Configure local kubeconfig access
-9. **Verification**: Validate successful cluster join
-
-### Key Variables
-- `cluster_name`: Name of the Kubernetes cluster
-- `ip_address`: IP address of the current control plane node
-- `first_control_plane_host`: Hostname/IP of the first control plane node
-- `kubernetes_services_control_plane`: List of firewall services to open
-- `join_token_ttl`: TTL for join tokens (default: 24h)
-- `certificate_key_ttl`: TTL for certificate keys (default: 2h)
-
-### External Role Interfaces
-- **dns-manager**: Provides DNS record creation with `host_name` variable
-- **kubeconfig-manager**: Handles kubeconfig merging with `cluster_name` variable
-- **First Control Plane**: Source for join tokens and certificate keys
-
-## Data Models
-
-### Join Credentials Structure
-```yaml
-join_credentials:
-  token: "abcdef.1234567890abcdef"
-  discovery_token_ca_cert_hash: "sha256:..."
-  certificate_key: "..."
-  api_server_endpoint: "cluster-name:6443"
-```
-
-### Firewall Services
-```yaml
-kubernetes_services_control_plane:
-  - kubernetes_API      # Port 6443
-  - etcd               # Ports 2379-2380
-  - kubelet            # Port 10250
-  - kube-scheduler     # Port 10259
-  - kube-controller-manager  # Port 10257
-```
-
-### Node Status Tracking
-```yaml
-node_status:
-  joined: false
-  kubelet_running: false
-  dns_configured: false
-  kubeconfig_ready: false
-```
-
-## Error Handling
-
-### Join Token Management
-- **Token Expiration**: Automatically generate new tokens if existing ones are expired
-- **Certificate Key Rotation**: Handle certificate key expiration gracefully
-- **Network Connectivity**: Retry join operations with exponential backoff
-- **API Server Availability**: Wait for API server readiness before attempting join
-
-### Idempotency Checks
-- **Already Joined Nodes**: Skip join process if node is already part of the cluster
-- **Existing Configuration**: Preserve existing kubelet configuration if valid
-- **DNS Records**: Update existing DNS records instead of creating duplicates
-- **Service Status**: Only restart services if configuration changes
-
-### Failure Recovery
-- **Partial Join Failures**: Clean up partial configurations and retry
-- **Network Issues**: Provide clear error messages for connectivity problems
-- **Permission Errors**: Validate sudo/root access before attempting operations
-- **Resource Constraints**: Check system resources before proceeding
-
-## Testing Strategy
-
-### Unit Testing Approach
-- **Task Validation**: Test individual tasks with mock data
-- **Variable Validation**: Ensure required variables are properly defined
-- **Conditional Logic**: Test all conditional branches in tasks
-- **Error Scenarios**: Validate error handling for common failure cases
-
-### Integration Testing
-- **Multi-Node Clusters**: Test with 3 and 5 control plane node configurations
-- **Network Scenarios**: Test across different network topologies
-- **OS Compatibility**: Validate on supported operating systems (Ubuntu/Debian)
-- **Version Compatibility**: Test with different Kubernetes versions
-
-### Validation Checks
-- **Cluster Health**: Verify all control plane nodes are healthy after join
-- **API Availability**: Confirm API server is accessible from all nodes
-- **Etcd Cluster**: Validate etcd cluster membership and health
-- **Scheduling**: Test pod scheduling across all control plane nodes
-- **Failover**: Verify cluster continues operating if one control plane fails
-
-### Test Scenarios
-1. **Fresh Join**: Join additional control plane to newly created cluster
-2. **Existing Cluster**: Add control plane to cluster with existing workloads
-3. **Network Partitions**: Test behavior during temporary network issues
-4. **Token Expiration**: Handle expired join tokens gracefully
-5. **Retry Operations**: Validate retry logic for transient failures
-
-## Implementation Considerations
-
-### Security
-- **Token Security**: Ensure join tokens are handled securely and not logged
-- **Certificate Management**: Properly manage and rotate certificate keys
-- **Network Security**: Validate firewall rules don't expose unnecessary ports
-- **Access Control**: Ensure proper RBAC is maintained after node joins
-
-### Performance
-- **Parallel Execution**: Support joining multiple control plane nodes simultaneously
-- **Resource Usage**: Monitor CPU and memory usage during join process
-- **Network Bandwidth**: Optimize data transfer during cluster join
-- **Startup Time**: Minimize time to achieve cluster readiness
-
-### Monitoring and Observability
-- **Join Progress**: Provide clear progress indicators during join process
-- **Health Checks**: Implement comprehensive health validation
-- **Logging**: Ensure adequate logging for troubleshooting
-- **Metrics**: Expose relevant metrics for monitoring cluster growth
-
-### Compatibility
-- **Kubernetes Versions**: Support current and previous Kubernetes versions
-- **Operating Systems**: Maintain compatibility with Ubuntu and Debian
-- **Container Runtimes**: Work with containerd runtime configuration
-- **Network Plugins**: Compatible with Flannel CNI configuration

.kiro/specs/fastpass-additional-control-plane/requirements.md

@@ -1,77 +0,0 @@
-# Requirements Document
-
-## Introduction
-
-This feature involves creating an Ansible role called `fastpass-additional-control-plane` that will deploy additional control plane nodes to an existing FastPass Kubernetes cluster. The role will follow the same pattern as the existing `fastpass-first-control-plane` role but will focus on joining nodes to an already initialized cluster rather than initializing a new cluster. This ensures high availability for the Kubernetes control plane by adding redundant master nodes.
-
-## Requirements
-
-### Requirement 1
-
-**User Story:** As a DevOps engineer, I want to deploy additional control plane nodes to my FastPass Kubernetes cluster, so that I can achieve high availability and fault tolerance for the cluster control plane.
-
-#### Acceptance Criteria
-
-1. WHEN the role is executed on a node THEN the system SHALL join the node to the existing Kubernetes cluster as a control plane node
-2. WHEN the role runs THEN the system SHALL configure the necessary firewall rules for control plane services
-3. WHEN the role executes THEN the system SHALL ensure the kubelet service is properly configured and running
-4. WHEN joining the cluster THEN the system SHALL use the correct join token and certificate key from the first control plane node
-5. WHEN the role completes THEN the system SHALL verify the node has successfully joined as a control plane node
-
-### Requirement 2
-
-**User Story:** As a system administrator, I want the additional control plane role to follow the same patterns as the first control plane role, so that the codebase remains consistent and maintainable.
-
-#### Acceptance Criteria
-
-1. WHEN the role is created THEN the system SHALL follow the same directory structure as fastpass-first-control-plane
-2. WHEN the role is implemented THEN the system SHALL use similar variable naming conventions and task organization
-3. WHEN the role runs THEN the system SHALL include proper error handling and idempotency checks
-4. WHEN the role executes THEN the system SHALL use the same firewall service definitions as the first control plane role
-5. WHEN the role is documented THEN the system SHALL include proper metadata headers with author, version, and description
-
-### Requirement 3
-
-**User Story:** As a cluster operator, I want the additional control plane nodes to have proper DNS configuration, so that they can be reached by their cluster names and participate in load balancing.
-
-#### Acceptance Criteria
-
-1. WHEN the role runs THEN the system SHALL configure DNS records for the additional control plane nodes
-2. WHEN DNS is configured THEN the system SHALL use the dns-manager role for consistency
-3. WHEN the role executes THEN the system SHALL ensure the node can resolve the cluster endpoint
-4. WHEN DNS setup completes THEN the system SHALL verify connectivity to the cluster API endpoint
-
-### Requirement 4
-
-**User Story:** As a DevOps engineer, I want the role to handle kubeconfig management for additional control plane nodes, so that I can manage the cluster from any control plane node.
-
-#### Acceptance Criteria
-
-1. WHEN the role completes THEN the system SHALL configure kubeconfig for the new control plane node
-2. WHEN kubeconfig is set up THEN the system SHALL use the kubeconfig-manager role for consistency
-3. WHEN the role runs THEN the system SHALL ensure proper permissions are set on kubeconfig files
-4. WHEN kubeconfig is configured THEN the system SHALL verify kubectl access works from the new node
-
-### Requirement 5
-
-**User Story:** As a system administrator, I want the role to be idempotent and handle edge cases, so that I can run it multiple times safely without causing issues.
-
-#### Acceptance Criteria
-
-1. WHEN the role is run multiple times THEN the system SHALL not attempt to rejoin an already joined node
-2. WHEN a node is already part of the cluster THEN the system SHALL skip the join process gracefully
-3. WHEN the role encounters errors THEN the system SHALL provide clear error messages and fail gracefully
-4. WHEN prerequisites are missing THEN the system SHALL report what needs to be configured first
-5. WHEN the role runs THEN the system SHALL validate that required variables are defined
-
-### Requirement 6
-
-**User Story:** As a cluster administrator, I want the role to integrate seamlessly with the existing FastPass deployment workflow, so that it can be used in the 4-step deployment process.
-
-#### Acceptance Criteria
-
-1. WHEN the role is created THEN the system SHALL be compatible with the deploy-fastpass-4step.yml playbook
-2. WHEN the role runs THEN the system SHALL work with the fastpass_control_plane[1:] host group
-3. WHEN integrated THEN the system SHALL not interfere with the first control plane initialization
-4. WHEN the role executes THEN the system SHALL depend on the first control plane node being ready
-5. WHEN deployment completes THEN the system SHALL allow worker nodes to join the cluster successfully

.kiro/specs/fastpass-additional-control-plane/tasks.md

@@ -1,118 +0,0 @@
-# Implementation Plan
-
-- [ ] 1. Create role directory structure and basic configuration
-  - Create the fastpass-additional-control-plane role directory structure
-  - Set up defaults/main.yml with required variables and firewall services
-  - Create meta/main.yml with role metadata and dependencies
-  - _Requirements: 2.1, 2.2, 2.4_
-
-- [ ] 2. Implement join token and certificate key retrieval
-  - [ ] 2.1 Create tasks to generate new join tokens from first control plane
-    - Write Ansible tasks to execute kubeadm token create on first control plane node
-    - Implement token validation and expiration checking
-    - Add error handling for token generation failures
-    - _Requirements: 1.4, 5.4_
-
-  - [ ] 2.2 Implement certificate key retrieval and management
-    - Create tasks to upload and retrieve certificate keys from first control plane
-    - Add certificate key expiration handling and rotation
-    - Implement secure handling of certificate keys in variables
-    - _Requirements: 1.4, 5.1_
-
-  - [ ] 2.3 Create discovery token CA certificate hash retrieval
-    - Write tasks to extract CA certificate hash from first control plane
-    - Implement validation of certificate hash format
-    - Add error handling for certificate retrieval failures
-    - _Requirements: 1.4, 5.4_
-
-- [ ] 3. Implement DNS configuration and firewall setup
-  - [ ] 3.1 Configure DNS records for additional control plane nodes
-    - Integrate dns-manager role for consistent DNS record creation
-    - Pass appropriate host_name variable to dns-manager
-    - Add DNS propagation wait and validation
-    - _Requirements: 3.1, 3.2, 3.4_
-
-  - [ ] 3.2 Set up firewall rules for control plane services
-    - Reuse kubernetes_services_control_plane from defaults
-    - Implement UFW firewall rule creation for Debian/Ubuntu systems
-    - Add conditional logic for different operating systems
-    - _Requirements: 1.2, 2.4_
-
-- [ ] 4. Implement kubelet configuration and cluster join
-  - [ ] 4.1 Create initial kubelet configuration
-    - Write kubelet config.yaml with systemd cgroup driver
-    - Set containerd socket endpoint configuration
-    - Ensure proper file permissions and ownership
-    - _Requirements: 1.3, 2.3_
-
-  - [ ] 4.2 Execute kubeadm join for control plane
-    - Implement kubeadm join command with control-plane flag
-    - Use retrieved join token, certificate key, and CA cert hash
-    - Add proper command argument construction and validation
-    - Include idempotency checks to prevent duplicate joins
-    - _Requirements: 1.1, 1.4, 5.1, 5.2_
-
-  - [ ] 4.3 Ensure kubelet service management
-    - Enable and start kubelet systemd service
-    - Add service status validation and error handling
-    - Implement service restart logic if needed
-    - _Requirements: 1.3, 1.5_
-
-- [ ] 5. Implement kubeconfig management and validation
-  - [ ] 5.1 Configure kubeconfig for additional control plane nodes
-    - Integrate kubeconfig-manager role for consistent configuration
-    - Pass cluster_name variable to kubeconfig-manager
-    - Ensure proper kubeconfig merging with existing configurations
-    - _Requirements: 4.1, 4.2, 4.3_
-
-  - [ ] 5.2 Implement cluster join validation
-    - Create tasks to verify node successfully joined as control plane
-    - Add kubectl commands to check node status and roles
-    - Implement cluster health validation checks
-    - _Requirements: 1.5, 4.4_
-
-- [ ] 6. Add comprehensive error handling and idempotency
-  - [ ] 6.1 Implement pre-flight validation checks
-    - Check if node is already joined to cluster
-    - Validate required variables are defined
-    - Verify first control plane node accessibility
-    - Add system resource and prerequisite checks
-    - _Requirements: 5.1, 5.2, 5.4, 5.5_
-
-  - [ ] 6.2 Add retry logic and failure recovery
-    - Implement retry mechanisms for transient failures
-    - Add exponential backoff for network-related operations
-    - Create cleanup tasks for partial join failures
-    - _Requirements: 5.3, 5.4_
-
-- [ ] 7. Integration with FastPass deployment workflow
-  - [ ] 7.1 Ensure compatibility with deploy-fastpass-4step.yml
-    - Verify role works with fastpass_control_plane[1:] host group
-    - Test integration with existing playbook structure
-    - Validate dependency on first control plane completion
-    - _Requirements: 6.1, 6.2, 6.3, 6.4_
-
-  - [ ] 7.2 Add proper task documentation and metadata
-    - Include role header with author, version, and description
-    - Add inline comments for complex task logic
-    - Document required variables and their purposes
-    - _Requirements: 2.2, 2.5_
-
-- [ ]* 8. Create comprehensive testing and validation
-  - [ ]* 8.1 Write unit tests for individual tasks
-    - Create test cases for token retrieval logic
-    - Test kubeadm join command construction
-    - Validate error handling scenarios
-    - _Requirements: 1.1, 1.4, 5.1_
-
-  - [ ]* 8.2 Implement integration tests
-    - Test multi-node control plane deployment
-    - Validate cluster health after additional nodes join
-    - Test failover scenarios and cluster resilience
-    - _Requirements: 1.5, 6.5_
-
-  - [ ]* 8.3 Add validation scripts and health checks
-    - Create scripts to verify cluster state after deployment
-    - Implement automated health validation
-    - Add performance and resource usage monitoring
-    - _Requirements: 1.5, 4.4_

.kiro/specs/fastpass-dns-loadbalancer-fix/requirements.md

@@ -1,51 +0,0 @@
-# Requirements Document
-
-## Introduction
-
-The FastPass Kubernetes cluster deployment currently has critical DNS and load balancing configuration issues that prevent proper high availability setup. While the cluster endpoint `fastpass.local.mk-labs.cloud` is defined in the group variables, the `cluster_vip` variable required by the DNS manager role is missing, and the Traefik load balancer configuration is commented out. This means the cluster endpoint cannot resolve properly and there's no load balancing for the control plane API. This feature will fix these configuration gaps to enable true HA functionality.
-
-## Requirements
-
-### Requirement 1: DNS CNAME Record for Load Balancer
-
-**User Story:** As a DevOps engineer, I want the DNS manager to create a CNAME record for the cluster endpoint pointing to the load balancer, so that the cluster endpoint resolves through the load balancer rather than directly to node IPs.
-
-#### Acceptance Criteria
-
-1. WHEN the dns-manager role is called for a load-balanced cluster THEN the system SHALL create a CNAME record instead of an A record
-2. WHEN the CNAME record is created THEN the system SHALL point fastpass.local.mk-labs.cloud to the traefik_server (lightning_lane.local.mk-labs.cloud)
-3. WHEN the DNS record type is determined THEN the system SHALL use CNAME for load-balanced endpoints and A records for direct node access
-4. WHEN DNS propagation occurs THEN the system SHALL verify that the CNAME resolution works correctly
-
-### Requirement 2: Complete Traefik Integration
-
-**User Story:** As a DevOps engineer, I want the Traefik load balancer to be fully integrated with the FastPass deployment, so that the cluster VIP is properly load balanced across all control plane nodes.
-
-#### Acceptance Criteria
-
-1. WHEN the traefik-manager role is called THEN the system SHALL use the traefik_server variable (lightning_lane) as the target host
-2. WHEN Traefik configuration is generated THEN the system SHALL create proper TCP routing for the cluster endpoint to all control plane nodes
-3. WHEN the cluster VIP is accessed THEN the system SHALL distribute requests across space-mountain, big-thunder-mountain, and splash-mountain
-4. WHEN Traefik configuration is applied THEN the system SHALL reload the Traefik service to activate the new configuration
-
-### Requirement 3: High Availability Validation
-
-**User Story:** As a DevOps engineer, I want to validate that the HA setup is working correctly, so that I can be confident the cluster will survive node failures.
-
-#### Acceptance Criteria
-
-1. WHEN the deployment completes THEN the system SHALL test connectivity to the cluster endpoint
-2. WHEN connectivity tests run THEN the system SHALL verify that the endpoint resolves through the CNAME to the load balancer
-3. WHEN load balancer tests run THEN the system SHALL verify that requests are being distributed across control plane nodes
-4. WHEN a control plane node is stopped THEN the system SHALL continue to serve API requests through the remaining nodes
-
-### Requirement 4: Backward Compatibility
-
-**User Story:** As a DevOps engineer, I want the DNS fixes to be backward compatible with existing deployments, so that current clusters continue to function during the transition.
-
-#### Acceptance Criteria
-
-1. WHEN existing clusters are updated THEN the system SHALL not break existing DNS configurations
-2. WHEN new variables are introduced THEN the system SHALL provide sensible defaults for existing deployments
-3. WHEN the update is applied THEN the system SHALL preserve existing kubeconfig files and cluster access
-4. IF migration issues occur THEN the system SHALL provide rollback procedures and documentation

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: talos/talhelper/talenv.yaml
+    age: age1xkyuv8r8ce6lu3d64jfspz4e50k6pxlaxwmuplzrtnpfnnrnycaq6mfsrn

COUCHDB-ERLANGCOOKIE-FIX.md

@@ -0,0 +1,160 @@
+# CouchDB erlangCookie Fix - Implementation Guide
+
+## Summary
+
+**Problem**: CouchDB deployment fails because `erlangCookie` is missing from the ExternalSecret configuration.
+
+**Decision**: Externalize `erlangCookie` to 1Password (pragmatic approach)
+
+**Rationale**: 
+- ExternalSecret architecture requires ownership of the entire secret
+- Mixing externalized and chart-generated fields in the same secret is not supported
+- Single-node deployment makes erlangCookie rotation unnecessary
+- This is an acceptable deviation from the pure Harbor pattern given the architectural constraints
+
+## Implementation Steps
+
+### 1. Generate erlangCookie Value
+
+```bash
+openssl rand -hex 20
+```
+
+Example output: `f4e3c2b1a9d8e7f6c5b4a3d2e1f0a9b8c7d6e5f4`
+
+### 2. Add to 1Password
+
+- **Vault**: `mk-labs`
+- **Item**: `couchdb`
+- **Field Name**: `erlang-cookie`
+- **Field Type**: password (concealed)
+- **Value**: `<paste generated value from step 1>`
+
+### 3. Update ExternalSecret Configuration
+
+File: `cluster/applications/couchdb/externalsecret.yaml`
+
+```yaml
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: couchdb-credentials
+  namespace: couchdb
+  labels:
+    app.kubernetes.io/name: couchdb
+    app.kubernetes.io/part-of: mk-labs
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: couchdb-admin
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        adminUsername: "admin"
+        adminPassword: "{{ .adminPassword }}"
+        cookieAuthSecret: "{{ .cookieAuthSecret }}"
+        erlangCookie: "{{ .erlangCookie }}"  # ← ADD THIS LINE
+  data:
+    - secretKey: adminPassword
+      remoteRef:
+        key: couchdb
+        property: admin-password
+    - secretKey: cookieAuthSecret
+      remoteRef:
+        key: couchdb
+        property: cookie-auth-secret
+    - secretKey: erlangCookie  # ← ADD THIS BLOCK
+      remoteRef:
+        key: couchdb
+        property: erlang-cookie
+```
+
+### 4. Update values.yaml Documentation (Optional)
+
+File: `cluster/applications/couchdb/values.yaml`
+
+Update the comment block at line 9-10:
+
+```yaml
+# Admin credentials managed via ExternalSecret
+# See externalsecret.yaml for 1Password integration
+#
+# NOTE: erlangCookie is externalized to 1Password for architectural
+# simplicity (ExternalSecret ownership model). In a pure Harbor pattern,
+# this would be chart-generated, but single-node deployment makes this
+# acceptable. The erlangCookie is treated as an immutable infrastructure
+# secret (generate once, never rotate).
+createAdminSecret: false
+extraSecretName: "couchdb-admin"
+```
+
+### 5. Commit and Push
+
+```bash
+cd ~/git/homelab
+git add cluster/applications/couchdb/externalsecret.yaml
+git add cluster/applications/couchdb/values.yaml  # if modified
+git commit -m "fix(couchdb): add erlangCookie to ExternalSecret from 1Password"
+git push origin main
+```
+
+### 6. Verify Deployment
+
+```bash
+# Watch ExternalSecret sync
+kubectl get externalsecret -n couchdb couchdb-credentials -w
+# Wait for: SecretSynced
+
+# Verify secret created with all four keys
+kubectl get secret -n couchdb couchdb-admin -o yaml
+# Should contain: adminUsername, adminPassword, cookieAuthSecret, erlangCookie
+
+# Watch ArgoCD sync
+kubectl get application -n argocd couchdb -w
+# Wait for: Healthy/Synced
+
+# Watch pod startup
+kubectl get pods -n couchdb -w
+# Wait for: Running
+
+# Test CouchDB access
+kubectl port-forward -n couchdb svc/couchdb-svc-couchdb 5984:5984 &
+curl http://localhost:5984/
+# Expected: {"couchdb":"Welcome","version":"3.5.1"}
+```
+
+## Why Not Follow Harbor Pattern Exactly?
+
+**Harbor Pattern**: Only user-facing credentials externalized, internal secrets chart-generated.
+
+**CouchDB Constraint**: ExternalSecret uses `creationPolicy: Owner`, which takes full ownership of the target secret. This prevents the Helm chart from adding auto-generated fields to the same secret.
+
+**Options Considered**:
+1. ✅ **Externalize erlangCookie** (SELECTED) - Works with current architecture
+2. ❌ Chart auto-generation - Conflicts with ExternalSecret ownership
+3. ❌ Dual-secret approach - Requires Helm chart customization
+4. ❌ Disable ExternalSecret - Loses 1Password integration for admin password
+
+**Decision**: Pragmatic approach wins. erlangCookie is treated as an infrastructure secret (generate once, never rotate), which is acceptable for a single-node deployment.
+
+## Secret Classification
+
+| Secret           | Type          | 1Password? | Rationale                          |
+|------------------|---------------|------------|------------------------------------|
+| adminUsername    | User-facing   | No*        | Static value, hardcoded in template |
+| adminPassword    | User-facing   | ✅ YES     | User login credential              |
+| cookieAuthSecret | Gray area     | ✅ YES     | Session security, periodic rotation |
+| erlangCookie     | Internal      | ✅ YES**   | Architectural constraint           |
+
+\* Hardcoded in ExternalSecret template (not fetched from 1Password)  
+\*\* Pragmatic deviation from Harbor pattern due to ExternalSecret architecture
+
+## References
+
+- Full analysis: `/home/hermes/couchdb-erlangcookie-analysis.txt`
+- Harbor pattern: `/home/hermes/harbor-simplification-complete.txt`
+- CouchDB Helm chart: `apache/couchdb` v4.6.3

README.md

@@ -1,239 +1,102 @@
-# A Homelab based on Red Hat Technologies
+# mk-labs
 
-A comprehensive homelab for learning advanced concepts primarily based on Red Hat OpenShift.  In addition to providing services, it is an area to incorporate container technologies, and enterprise integration scenarios.
+Automated infrastructure provisioning and configuration for a personal homelab, built on GitOps practices with clear tool responsibility boundaries.
 
-This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
+## Architecture
 
-## 🎯 Project Goals
-
-- **Kubernetes cluster for applications**
-- **IAM integration testing**
-- **GitOps and automation workflows**
-
-## 📋 Documentation (Priority Order)
-
-### Phase 1: Foundation
-1. **[Overview & Hardware Allocation](./docs/01-overview.md)** - Complete architecture overview
-2. **[Networking Plan](./docs/02-networking.md)** - VLAN strategy and network design
-3. **[Core Services Setup](./docs/03-core-services.md)** *(TBD)* - Ansible, DNS, monitoring
-4. **[Storage Configuration](./docs/04-storage.md)** *(TBD)* - Synology, democratic-csi
-
-### Phase 2: Proxmox Platform
-5. **[Proxmox Installation](./docs/11-vsphere-setup.md)** *(TBD)* - Dell 7050 virtualization
-6. **[VM Templates & Automation](./docs/13-vm-automation.md)** *(TBD)* - Template creation
-
-### Phase 3: Infrastructure Services
-7. **[Recursive DNS]
-8. **[Authoritative DNS]
-9. **[Identity Management](./docs/10-acm-setup.md)** *(TBD)*
-10. **[Matchbox] (Depreciated?)
-
-### Phase 4: OpenShift Clusters (Depreciated)
-8. **[OpenShift SNO + Worker](./docs/09-openshift-sno.md)** *(TBD)* - ACM Hub Cluster
-9. **[OpenShift Cluster](./docs/08-openshift-compact.md)** *(TBD)* - 3 Master/3 Worker node (production-like)
-10. **[ACM Configuration](./docs/10-acm-setup.md)** *(TBD)* - Multi-cluster management
-11. **[HCP Cluster](./docs/10-acm-setup.md)** *(TBD)* - External app cluster
-
-### Phase 5: Kubernetes Container Platform
-5. **[Container Registry Setup](./docs/05-container-registry.md)** *(TBD)* - Harbor deployment
-6. **[Git Repository Setup](./docs/06-git-repository.md)** *(TBD)* - Gitea/GitLab on Synology
-7. **[Artifact Repository](./docs/07-artifact-repository.md)** *(TBD)* - Nexus/Artifactory
-
-### Phase 6: Advanced Services
-14. **[Monitoring & Observability](./docs/14-monitoring.md)** *(TBD)* - Prometheus, Grafana, Splunk
-15. **[Security & Compliance](./docs/15-security.md)** *(TBD)* - ACS, certificates, auditing
-16. **[Backup & DR](./docs/16-backup-dr.md)** *(TBD)* - Backup strategies
-
-## 🚀 Quick Start Deployment
-
-### Prerequisites
-- Ubiquiti UDM Pro configured
-- Hardware powered and networked
-- Initial VLAN setup (see [networking plan](./docs/02-networking.md))
-
-### Ansible Collections
-- ansible-galaxy collection install freeipa.ansible_freeipa
-
-### Deployment Scripts
-
-```bash
-source ~/venv-ansible/bin/activate
-# Phase 1: Foundation
-./scripts/01-network-setup.sh
-./scripts/02-core-services-deploy.sh
-
-# Phase 2: Container Platform  
-./deployment/synology/docker-compose.yml  # Git repo, Harbor, Nexus
-./scripts/03-storage-setup.sh
-
-# Phase 3: OpenShift
-./deployment/openshift/compact-cluster/
-./deployment/openshift/sno-cluster/
-
-# Phase 4: Proxmox
-./deployment/proxmox/
+A single operator action — setting a VM record's status to **Staged** in NetBox — triggers a fully automated provisioning pipeline:
+```
+NetBox (webhook) → n8n (validate & orchestrate) → Terraform (create VM + DHCP)
+                                                 → Ansible (OS config + DNS + status update)
 ```
 
-## 📁 Repository Structure
+| Tool | Host | IP | Responsibility |
+|------|------|----|---------------|
+| NetBox | fire-station | 10.1.71.102 | Source of truth — VM records, IP allocation, VLAN data |
+| n8n | tiki-room | 10.1.71.23 | Event orchestration, validation, pipeline sequencing |
+| Terraform | city-hall | 10.1.71.35 | Proxmox VM lifecycle, Unifi DHCP reservations |
+| Ansible / Semaphore | imagineering | 10.1.71.22 | OS configuration, DNS records, NetBox status updates |
+| Proxmox | fantasyland | 10.1.71.13 | Target hypervisor |
 
+All systems on the Server Trusted VLAN (10.1.71.0/24).
+
+## Repository Structure
 ```
 homelab/
-├── README.md                    # This file
-├── docs/                        # Documentation (numbered by priority)
-│   ├── 01-overview.md
-│   ├── 02-networking.md
-│   └── ...
-├── ansible/                     # Directory structure for Ansible 
-├── deployment/                  # Deployment 
-configurations
-│   ├── synology/                # Docker Compose files for Synology
-│   ├── k0s/                     # k0s cluster manifests
-│   ├── openshift/               # OpenShift installation configs
-│   └── proxmox/                 # Proxmox automation
-├── scripts/                     # Automation scripts
-└── .gitignore                   # Excludes sensitive data
+├── ansible/
+│   ├── inventory/          # NetBox dynamic inventory + static
+│   ├── playbooks/          # Runnable playbooks (vm-provision, DNS, OS updates)
+│   ├── roles/              # vm-baseline, dns-manager, common, haproxy, n8n, observer, etc.
+│   ├── tasks/              # Shared includable task files
+│   ├── group_vars/         # Group variable definitions
+│   ├── host_vars/          # Per-host variable definitions
+│   ├── templates/          # Jinja2 templates
+│   └── ansible.cfg
+│
+├── terraform/
+│   ├── proxmox/vm/         # bpg/proxmox provider — VM creation from templates
+│   ├── unifi/dhcp/         # Unifi provider — DHCP static reservations on UDM Pro
+│   └── dns/                # DNS record management
+│
+├── packer/
+│   ├── ubuntu-24.04/       # Ubuntu 24.04 VM template (small → xlarge-plus sizes)
+│   └── fedora-42/          # Fedora 42 VM template
+│
+├── n8n/
+│   └── workflows/          # Exported n8n workflow JSON (vm-provisioning)
+│
+├── netbox/
+│   └── initializers/       # Custom fields, VLANs, IP prefixes as code
+│
+└── docs/
+    └── decisions/          # Architecture decision records
 ```
 
-## 🔧 Technology Stack
+## Pipeline Flow
 
-### Infrastructure
-- **Networking**: Ubiquiti UDM Pro
-- **Storage**: Synology DS1621+, Ubiquiti UNAS Pro
-- **Compute**: 3x Minisforum TH60, 2x Minisforum MS01, 7x Dell 7050 SFF
+| # | System | Action |
+|---|--------|--------|
+| 1 | NetBox | Operator sets VM status to Staged → webhook fires |
+| 2 | n8n | Validates payload (hostname, IP, VLAN, template, proxmox_node) |
+| 3 | n8n → city-hall | SSH + `terraform apply` — creates VM on Proxmox |
+| 4 | n8n | Queries Proxmox API for MAC address |
+| 5 | n8n → NetBox | Writes MAC to VM interface record |
+| 6 | n8n → city-hall | SSH + `terraform apply` — creates DHCP reservation on UDM Pro |
+| 7 | n8n → imagineering | Triggers Ansible via Semaphore API |
+| 8 | Ansible | OS baseline, SSH hardening, Technitium DNS A record |
+| 9 | Ansible → NetBox | Sets VM status to Active |
 
-### Container Platforms
-- **k8s**: Core services cluster
-- **Proxmox**: VM workloads
-
-### Core Services
-- **Container Registry**: Harbor
-- **Git Repository**: Gitea/GitLab CE
-- **Artifact Repository**: Nexus/Artifactory
-- **Monitoring**: Prometheus + Grafana
-- **Logging**: Splunk Enterprise
-- **DNS**: CoreDNS
-- **Load Balancing**: MetalLB + HAProxy
-
-## 🔐 Security Notes
-
-- **No sensitive data** is stored in this repository
-- **Secrets management** via external-secrets-operator
-- **Certificate management** via cert-manager
-- **Network segmentation** via VLANs and firewall rules
-
-## 🤝 Contributing
-
-This is a personal homelab project, but feel free to:
-- Submit issues for questions or suggestions
-- Fork for your own homelab adaptations
-- Share improvements via pull requests
-
-## 📞 Next Steps
-
-1. **Create GitHub repository** for version control
-2. **Start with Phase 1** foundation setup
-3. **Build deployment automation** as we go
-4. **Document lessons learned** for future reference
-
----
-
-**Status**: 🚧 Planning & Initial Development
-
-**Last Updated**: June 2025
-
-This repo is a mono-repo that is broken up into three sections:
-
-- infra-config
-- apps
-- cluster
+On any failure, NetBox status is set to **Failed**. No auto-retry — operator investigates.
 
 ## Hardware
 
-- Dell 7050 SFF (7)
-- Minisforum TH60 (3)
-- Minisforum MS01 (2)
-- Synology 1621+
+- 7× Dell 7050 SFF
+- 3× Minisforum TH60
+- 2× Minisforum MS01
+- Synology DS1621+
+- Ubiquiti UDM Pro
 
-## Software
+## Software Stack
 
-- Proxmox (Virtualization)
-- Cloudflare (Domain Hosting, Public DNS)
-- Unbound (Recursive DNS)
-- FreeIPA (Identity management, Authoritive DNS)
-- Matchbox (iPXE)
-- Red Hat OpenShift
-- OpenShift Agent Based Installer (Install OpenShift)
-  - [Red Hat Advanced Cluster Management for Kubernetes](https://www.redhat.com/en/technologies/management/advanced-cluster-management)
-  - [Vault](https://www.hashicorp.com/en/products/vault)
-  - [OpenShift GitOps (ArgoCD)](https://www.redhat.com/en/technologies/cloud-computing/openshift/gitops)
-  - [Red Hat Ansible Automation Platform](https://www.redhat.com/en/technologies/management/ansible)
-
-## Prerequisites
-
-- Ansible user created
-- Ansible configured
-- [Networking](docs/networks.md)
-- [Proxmox](docs/proxmox.md) (In my homelab, internal DNS, identity manangement, and ipxe are hosted here.)
-- Matchbox
-- DNS
-- Domain Registration
-
-## Assumptions
-
-There are a dozen different architectures you could use to deploy OpenShift in every which way.
-For the sake of this documentation we'll assume the following:
+- **Virtualization**: Proxmox
+- **Automation**: Terraform, Ansible, n8n, Semaphore
+- **DNS**: Technitium (authoritative), Unbound (recursive)
+- **IPAM/DCIM**: NetBox
+- **Networking**: Ubiquiti UDM Pro
+- **Templates**: Packer (Ubuntu 24.04, Fedora 42)
 
 ## Getting Started
 
-[Step-by-Step Walkthrough](step-by-step.md)
+See [docs/decisions/vm-provisioning-flow.md](docs/decisions/vm-provisioning-flow.md) for the full architecture decision record.
 
-### Hub Cluster
+Previous OpenShift/ACM/Fastpass content is preserved in the `archive/pre-mk-labs` branch.
 
-You'll need an OpenShift "Hub Cluster" with access to persistant storage.
-A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a Hub cluster and run:
+## Security
 
-- Advanced Cluster Management
-- Ansible Automation Platform
-- Vault
-- ~~OpenShift GitOps~~
-
-#### Network Prerequisites
-
-The prerequisites for OpenShift in traditional and HCP patterns are largely the same - it just kind of depends on where your DNS records go to.
-
-| Cluster           | Endpoint    | VIP           | DNS A Record                      | Notes                           |
-|------------------|-------------|---------------|-----------------------------------|----------------------------------|
-| Hub Cluster (SNO) | App Ingress | 192.168.0.10 | *.apps.hub-cluster.example.com    | SNO App VIP goes to IP of node  |
-| Hub Cluster (SNO) | API         | 192.168.0.10 | api.hub-cluster.example.com       | SNO API goes to IP of node      |
-
-These DNS entries should be put in your Authoratitive DNS.
-
-#### ACM & GitOps Configuration
-
-Before you start creating clusters you may want to create some Policies, integrate ACM and ArgoCD, etc. This step is optional in case you're just interested in trying out Hosted Control Planes or copy/paste around a cluster for testing purposes.
-
-Find additional details in the ./02-rhacm-config folder.
-
-#### Creating a Cluster
-
-With everything in its right place, you can now start to declaratively create clusters
-
-./05-clusters/hcp-bmh - HCP to Bare Metal Hosts
-
-### Internal Cluster
-
-Two additional bare metal nodes, to be added to Advanced Cluster Management (ACM) running on the SNO Hub. These will be used to create another HCP cluster.
-These servers have a BMC interface with Redfish - if not, then you'll need to manually manage the boot and installation of those servers.
-This makes it to where you just need 3 bare metal nodes. You could run one HCP Bare Metal cluster with both of the other nodes, but then you have a shared storage requirement that can't be satisfied by ODF since that needs at least 3 nodes.
-
-### External Cluster
-
-You'll also either need you just need at least 2 bare metal nodes.
+No sensitive data is stored in this repository. Secrets are managed via Ansible Vault and environment variables on pipeline hosts.
 
 ---
 
-## Credits
+**Status**: 🚧 Active Development — VM Provisioning Pipeline
 
-- Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.
-- Ryan Etten
-- Andrew Potozniak
+**Last Updated**: February 2026

ansible/FASTPASS_DEPLOYMENT_GUIDE.md

@@ -1,309 +0,0 @@
-# FastPass Kubernetes Cluster - Complete Deployment Guide
-
-## Overview
-
-This guide provides step-by-step instructions for deploying a complete Kubernetes cluster on Fedora using Ansible automation. The FastPass cluster is designed for high availability with multiple control plane nodes and worker nodes.
-
-## Prerequisites
-
-### System Requirements
-- **OS**: Fedora 38+ (64-bit)
-- **Memory**: Minimum 2GB RAM per node
-- **CPU**: Minimum 2 cores per node
-- **Storage**: Minimum 10GB free space
-- **Network**: All nodes must be able to communicate
-
-### Software Requirements
-- Ansible 2.15+
-- Python 3.8+
-- SSH access to all nodes with sudo privileges
-
-## Quick Start
-
-### 1. Validate Your Setup
-
-Before deploying, run the validation script:
-
-```bash
-cd ansible
-./scripts/test-fastpass-deployment.sh
-```
-
-This will check:
-- ✅ Ansible installation
-- ✅ Inventory configuration
-- ✅ Playbook files
-- ✅ Role files
-- ✅ Group variables
-- ✅ Playbook syntax
-- ✅ Common issues
-
-### 2. Deploy the Cluster
-
-```bash
-# Deploy the complete cluster
-ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml
-```
-
-## Deployment Process
-
-The deployment follows this sequence:
-
-### Phase 1: System Preparation
-- **Hosts**: All FastPass nodes
-- **Tasks**: 
-  - Preflight checks (OS, memory, CPU, disk space)
-  - Disable swap and configure kernel modules
-  - Install and configure containerd
-  - Install Kubernetes packages
-
-### Phase 2: Control Plane Initialization
-- **Hosts**: First control plane node (`space-mountain`)
-- **Tasks**:
-  - Initialize the Kubernetes cluster
-  - Configure API server and etcd
-  - Install Flannel CNI
-  - Generate join commands
-
-### Phase 3: Additional Control Plane Nodes
-- **Hosts**: Remaining control plane nodes (`big-thunder-mountain`, `splash-mountain`)
-- **Tasks**:
-  - Join additional control plane nodes
-  - Configure high availability
-
-### Phase 4: Worker Nodes
-- **Hosts**: Worker nodes (`haunted-mansion`, `peter-pans-flight`)
-- **Tasks**:
-  - Join worker nodes to the cluster
-  - Apply node labels and taints
-
-### Phase 5: Validation
-- **Hosts**: First control plane node
-- **Tasks**:
-  - Verify all nodes are ready
-  - Check all pods are running
-  - Display final cluster status
-
-## Configuration
-
-### Inventory Structure
-
-Ensure your `inventory.yml` has the correct structure:
-
-```yaml
-fastpass_control_plane:
-  hosts:
-    space-mountain:
-    big-thunder-mountain:
-    splash-mountain:
-
-fastpass_workers:
-  hosts:
-    haunted-mansion:
-    peter-pans-flight:
-
-fastpass:
-  children:
-    fastpass_control_plane:
-    fastpass_workers:
-```
-
-### Group Variables
-
-Key variables in `group_vars/fastpass/vars`:
-
-```yaml
-# Cluster Configuration
-cluster_name: "fastpass"
-kubernetes_version: "1.33"
-pod_network_cidr: "10.244.0.0/16"
-service_cidr: "10.96.0.0/12"
-
-# Control Plane Configuration
-control_plane_endpoint: "fastpass.local.mk-labs.cloud"
-control_plane_port: "6443"
-
-# CNI Configuration
-cni_plugin: "flannel"
-
-# Node Labels
-node_labels:
-  zone:
-    # Control Plane nodes (masters) - no zone labels needed
-    # space-mountain: (control plane - no zone label)
-    # big-thunder-mountain: (control plane - no zone label)
-    # splash-mountain: (control plane - no zone label)
-    
-    # Worker nodes
-    haunted-mansion: "backstage"      # Internal/backstage workloads
-    peter-pans-flight: "backstage"    # Internal/backstage workloads
-    # Future node: "on-stage"         # External/on-stage workloads (future)
-```
-
-## Troubleshooting
-
-### Common Issues
-
-#### 1. Swap Enabled
-**Problem**: `running with swap on is not supported`
-**Solution**: The playbook automatically disables swap, but if it persists:
-```bash
-# On the problematic node
-sudo swapoff -a
-sudo systemctl restart kubelet
-```
-
-#### 2. CNI Not Ready
-**Problem**: `Network plugin returns error: cni plugin not initialized`
-**Solution**: The playbook installs Flannel automatically. If issues persist:
-```bash
-kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml
-```
-
-#### 3. Control Plane Endpoint Issues
-**Problem**: `unable to add a new control plane instance to a cluster that doesn't have a stable controlPlaneEndpoint`
-**Solution**: The playbook uses the first control plane node as the endpoint. For production, consider using a load balancer.
-
-#### 4. Permission Issues
-**Problem**: `User "kubernetes-admin" cannot create resource "secrets"`
-**Solution**: The playbook uses super-admin.conf for proper permissions.
-
-### Debug Commands
-
-```bash
-# Check node status
-kubectl get nodes -o wide
-
-# Check pod status
-kubectl get pods --all-namespaces
-
-# Check kubelet logs
-journalctl -u kubelet -f
-
-# Check API server logs
-kubectl logs -n kube-system kube-apiserver-space-mountain
-
-# Check CNI status
-kubectl get pods -n kube-flannel
-```
-
-## Post-Deployment
-
-### 1. Verify Cluster Health
-
-```bash
-# Check all nodes are ready
-kubectl get nodes -o wide
-
-# Check all pods are running
-kubectl get pods --all-namespaces
-
-# Test cluster connectivity
-kubectl cluster-info
-```
-
-### 2. Manage Kubeconfig
-
-Use the provided script to manage different cluster configurations:
-
-```bash
-# Switch to FastPass cluster
-./scripts/manage-kubeconfigs.sh fastpass
-
-# Check status
-./scripts/manage-kubeconfigs.sh status
-
-# Test connectivity
-./scripts/manage-kubeconfigs.sh test
-```
-
-### 3. Deploy Applications
-
-Your cluster is now ready for workloads:
-
-```bash
-# Deploy a test application
-kubectl run nginx --image=nginx --port=80
-
-# Create a service
-kubectl expose pod nginx --port=80 --type=NodePort
-
-# Check the service
-kubectl get svc nginx
-```
-
-## Maintenance
-
-### Adding New Nodes
-
-1. Add the new node to the inventory
-2. Run the preparation role:
-   ```bash
-   ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml --limit=new-node
-   ```
-3. Join the node to the cluster manually or extend the playbook
-
-### Upgrading Kubernetes
-
-1. Update the `kubernetes_version` variable
-2. Run the preparation role on all nodes
-3. Upgrade control plane nodes first
-4. Upgrade worker nodes
-
-### Backup and Recovery
-
-- Backup `/etc/kubernetes/` directory on control plane nodes
-- Backup etcd data: `etcdctl snapshot save backup.db`
-- Document cluster configuration
-
-## Architecture
-
-```
-FastPass Cluster Architecture:
-┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
-│  Control Plane  │    │  Control Plane  │    │  Control Plane  │
-│  space-mountain │    │big-thunder-mtn  │    │ splash-mountain │
-│   (Masters)     │    │   (Masters)     │    │   (Masters)     │
-│  No Zone Label  │    │  No Zone Label  │    │  No Zone Label  │
-└─────────────────┘    └─────────────────┘    └─────────────────┘
-         │                       │                       │
-         └───────────────────────┼───────────────────────┘
-                                 │
-         ┌───────────────────────┼───────────────────────┐
-         │                       │                       │
-┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
-│   Worker Node   │    │   Worker Node   │    │   Worker Node   │
-│ haunted-mansion │    │peter-pans-flight│    │  (Future)       │
-│   (Backstage)   │    │   (Backstage)   │    │   (On-Stage)    │
-│ zone=backstage  │    │ zone=backstage  │    │ zone=on-stage   │
-└─────────────────┘    └─────────────────┘    └─────────────────┘
-```
-
-## Support
-
-For issues specific to this deployment:
-1. Check the troubleshooting section
-2. Review Ansible logs with `-vvv` verbosity
-3. Check system logs on affected nodes
-4. Verify network connectivity between nodes
-
-## Files Structure
-
-```
-ansible/
-├── group_vars/
-│   └── fastpass/
-│       └── vars                    # Cluster configuration
-├── playbooks/
-│   ├── deploy-fastpass-cluster.yml # Main deployment playbook
-│   ├── deploy_k8s.yml             # Legacy deployment playbook
-│   └── roles/
-│       ├── kubernetes/             # System preparation
-│       ├── fastpass-control-plane/ # Control plane setup
-│       ├── fastpass-control-plane-join/ # Additional control plane nodes
-│       └── fastpass-workers/       # Worker node setup
-├── scripts/
-│   ├── test-fastpass-deployment.sh # Validation script
-│   └── manage-kubeconfigs.sh      # Kubeconfig management
-└── inventory.yml                   # Host inventory
-``` 

ansible/FASTPASS_README.md

@@ -1,228 +0,0 @@
-# FastPass Kubernetes Cluster - Fedora Deployment Guide
-
-## Overview
-
-This guide covers the deployment of a Kubernetes cluster on Fedora using Ansible automation. The FastPass cluster is designed for high availability with multiple control plane nodes and worker nodes.
-
-## Architecture
-
-```
-FastPass Cluster Architecture:
-┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
-│  Control Plane  │    │  Control Plane  │    │  Control Plane  │
-│  space-mountain │    │big-thunder-mtn  │    │ splash-mountain │
-│   (Leader)      │    │                 │    │                 │
-└─────────────────┘    └─────────────────┘    └─────────────────┘
-         │                       │                       │
-         └───────────────────────┼───────────────────────┘
-                                 │
-         ┌───────────────────────┼───────────────────────┐
-         │                       │                       │
-┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
-│   Worker Node   │    │   Worker Node   │    │   Worker Node   │
-│ haunted-mansion │    │peter-pans-flight│    │  (Future)       │
-│   (backstage)   │    │   (backstage)   │    │                 │
-└─────────────────┘    └─────────────────┘    └─────────────────┘
-```
-
-## Prerequisites
-
-### System Requirements
-- **OS**: Fedora 38+ (64-bit)
-- **Memory**: Minimum 2GB RAM per node
-- **CPU**: Minimum 2 cores per node
-- **Storage**: Minimum 10GB free space
-- **Network**: All nodes must be able to communicate
-
-### Software Requirements
-- Ansible 2.15+
-- Python 3.8+
-- SSH access to all nodes with sudo privileges
-
-## Quick Start
-
-### 1. Prepare Inventory
-
-Ensure your `inventory.yml` has the correct host groups:
-
-```yaml
-fastpass_control_plane:
-  hosts:
-    space-mountain:
-    big-thunder-mountain:
-    splash-mountain:
-
-fastpass_workers:
-  hosts:
-    haunted-mansion:
-    peter-pans-flight:
-
-fastpass:
-  children:
-    fastpass_control_plane:
-    fastpass_workers:
-```
-
-### 2. Configure Variables
-
-Edit `group_vars/fastpass/vars` to customize your deployment:
-
-```yaml
-# Cluster Configuration
-cluster_name: "fastpass"
-kubernetes_version: "1.33"
-pod_network_cidr: "10.244.0.0/16"
-service_cidr: "10.96.0.0/12"
-
-# Node Labels
-node_labels:
-  zone:
-    space-mountain: "external"
-    big-thunder-mountain: "external"
-    splash-mountain: "external"
-    haunted-mansion: "internal"
-    peter-pans-flight: "internal"
-```
-
-### 3. Deploy the Cluster
-
-```bash
-# Deploy the complete cluster
-ansible-playbook -i inventory.yml playbooks/deploy-fastpass-cluster.yml
-
-# Or deploy step by step
-ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml
-```
-
-## Deployment Process
-
-### Phase 1: System Preparation
-- Preflight checks (OS, memory, CPU, disk space)
-- Disable swap and configure kernel modules
-- Install and configure containerd
-- Install Kubernetes packages
-
-### Phase 2: Control Plane Setup
-- Initialize the first control plane node
-- Configure API server and etcd
-- Install Calico CNI
-- Join additional control plane nodes
-
-### Phase 3: Worker Node Setup
-- Join worker nodes to the cluster
-- Apply node labels and taints
-- Verify cluster health
-
-## Troubleshooting
-
-### Common Issues
-
-#### 1. Repository Errors
-**Problem**: Docker CE repository not found
-**Solution**: Update the repository URL in `container-runtime.yml`:
-```yaml
-baseurl: "https://download.docker.com/linux/fedora/{{ ansible_distribution_major_version }}/x86_64/stable"
-```
-
-#### 2. kubeadm Init Failures
-**Problem**: kubeadm init fails with preflight errors
-**Solution**: The playbook includes `--ignore-preflight-errors=all` flag
-
-#### 3. Node Not Ready
-**Problem**: Worker nodes stuck in NotReady state
-**Solution**: Check CNI installation and network connectivity
-
-### Debug Commands
-
-```bash
-# Check node status
-kubectl get nodes -o wide
-
-# Check pod status
-kubectl get pods --all-namespaces
-
-# Check kubelet logs
-journalctl -u kubelet -f
-
-# Check containerd status
-systemctl status containerd
-```
-
-## Customization
-
-### Network Configuration
-Modify the pod and service CIDRs in `group_vars/fastpass/vars`:
-
-```yaml
-pod_network_cidr: "10.244.0.0/16"
-service_cidr: "10.96.0.0/12"
-```
-
-### CNI Selection
-The default CNI is Calico. To change, modify the control plane role:
-
-```yaml
-cni_plugin: "flannel"  # or "weave", "cilium"
-```
-
-### Node Labels and Taints
-Configure node labels in `group_vars/fastpass/vars`:
-
-```yaml
-node_labels:
-  zone:
-    space-mountain: "external"
-    haunted-mansion: "internal"
-  environment: "production"
-  cluster: "fastpass"
-```
-
-## Maintenance
-
-### Adding New Nodes
-1. Add the new node to the inventory
-2. Run the preparation role: `ansible-playbook -i inventory.yml playbooks/deploy_k8s.yml --limit=new-node`
-3. Join the node to the cluster
-
-### Upgrading Kubernetes
-1. Update the `kubernetes_version` variable
-2. Run the preparation role on all nodes
-3. Upgrade control plane nodes first
-4. Upgrade worker nodes
-
-### Backup and Recovery
-- Backup `/etc/kubernetes/` directory on control plane nodes
-- Backup etcd data: `etcdctl snapshot save backup.db`
-- Document cluster configuration
-
-## Security Considerations
-
-- SELinux is set to permissive mode for compatibility
-- Firewalld is disabled (configure as needed for your environment)
-- Consider enabling RBAC and network policies
-- Regularly update Kubernetes and system packages
-
-## Support
-
-For issues specific to this deployment:
-1. Check the troubleshooting section
-2. Review Ansible logs with `-vvv` verbosity
-3. Check system logs on affected nodes
-4. Verify network connectivity between nodes
-
-## Files Structure
-
-```
-ansible/
-├── group_vars/
-│   └── fastpass/
-│       └── vars                    # Cluster configuration
-├── playbooks/
-│   ├── deploy-fastpass-cluster.yml # Main deployment playbook
-│   ├── deploy_k8s.yml             # Legacy deployment playbook
-│   └── roles/
-│       ├── kubernetes/             # System preparation
-│       ├── fastpass-control-plane/ # Control plane setup
-│       └── fastpass-workers/       # Worker node setup
-└── inventory.yml                   # Host inventory
-``` 

ansible/KUBECONFIG_MANAGEMENT.md

@@ -1,233 +0,0 @@
-# Kubeconfig Management - Modular & Repeatable
-
-This document explains the modular kubeconfig management system for your homelab's multiple Kubernetes clusters.
-
-## Overview
-
-The kubeconfig management has been refactored into reusable, modular components that can handle multiple clusters seamlessly:
-
-- **FastPass** (Vanilla Kubernetes)
-- **Hub Cluster** (OpenShift SNO)
-- **Internal Cluster** (OpenShift)
-- **Future clusters** (easily extensible)
-
-## Architecture
-
-```
-ansible/playbooks/roles/
-├── kubeconfig-manager/          # Core reusable role
-│   ├── tasks/main.yml          # Main entry point
-│   ├── tasks/merge-kubeconfig.yml  # Merging logic
-│   ├── defaults/main.yml       # Default variables
-│   └── README.md               # Role documentation
-├── cluster-kubeconfig/         # Generic wrapper role
-└── fastpass-first-control-plane/  # Uses kubeconfig-manager
-```
-
-## Quick Usage
-
-### 1. Using the Script (Easiest)
-
-```bash
-cd ansible
-
-# Setup FastPass cluster kubeconfig
-./scripts/setup-kubeconfig.sh fastpass fastpass_control_plane[0]
-
-# Setup Hub cluster kubeconfig  
-./scripts/setup-kubeconfig.sh hub hub_cluster
-
-# Setup Internal cluster kubeconfig
-./scripts/setup-kubeconfig.sh internal internal_cluster[0]
-```
-
-### 2. Direct Ansible Usage
-
-```bash
-# Single cluster
-ansible-playbook -i inventory.yml \
-  playbooks/examples/multi-cluster-kubeconfig.yml \
-  --limit fastpass_control_plane[0] \
-  -e target_cluster_name=fastpass
-
-# Multiple clusters at once
-ansible-playbook -i inventory.yml \
-  playbooks/examples/multi-cluster-kubeconfig.yml
-```
-
-### 3. In Your Own Playbooks
-
-```yaml
-- name: Setup kubeconfig for any cluster
-  hosts: my_cluster_nodes[0]
-  roles:
-    - role: kubeconfig-manager
-      vars:
-        cluster_name: "my-cluster"
-        kubeconfig_source_path: "/etc/kubernetes/admin.conf"
-```
-
-## Features
-
-### ✅ **Modular & Reusable**
-- Single role works with any Kubernetes cluster
-- Easy to extend for new clusters
-- Consistent behavior across all clusters
-
-### ✅ **Safe Operations**
-- Automatic backups before merging
-- Non-destructive merging
-- Preserves existing contexts
-
-### ✅ **Multi-Cluster Ready**
-- Unique naming: `cluster-name-admin`
-- No conflicts between clusters
-- Easy context switching
-
-### ✅ **Homelab Optimized**
-- Works with vanilla Kubernetes
-- Works with OpenShift
-- Handles different kubeconfig paths
-
-## Generated Structure
-
-After running the kubeconfig management:
-
-```bash
-~/.kube/
-├── config                      # Merged config with all clusters
-├── config-fastpass            # Individual cluster configs
-├── config-hub
-├── config-internal
-└── config.backup.1697123456   # Timestamped backups
-```
-
-## Context Management
-
-```bash
-# List all available contexts
-kubectl config get-contexts
-
-# Switch between clusters
-kubectl config use-context fastpass-admin
-kubectl config use-context hub-admin
-kubectl config use-context internal-admin
-
-# Check current context
-kubectl config current-context
-
-# Test connectivity
-kubectl cluster-info
-kubectl get nodes
-```
-
-## Integration with Existing Roles
-
-### Before (Monolithic)
-```yaml
-# fastpass-first-control-plane/tasks/main.yml
-- name: 50+ lines of kubeconfig logic
-  # Lots of repetitive code
-```
-
-### After (Modular)
-```yaml
-# fastpass-first-control-plane/tasks/main.yml
-- name: Setup kubeconfig for FastPass cluster
-  ansible.builtin.include_role:
-    name: kubeconfig-manager
-  vars:
-    cluster_name: "{{ cluster_name }}"
-```
-
-## Adding New Clusters
-
-To add a new cluster (e.g., "edge-cluster"):
-
-1. **Add to inventory:**
-```yaml
-edge_cluster:
-  hosts:
-    edge-node-01:
-```
-
-2. **Use the script:**
-```bash
-./scripts/setup-kubeconfig.sh edge edge_cluster[0]
-```
-
-3. **Or add to playbook:**
-```yaml
-- name: Setup kubeconfig for Edge cluster
-  hosts: edge_cluster[0]
-  roles:
-    - role: kubeconfig-manager
-      vars:
-        cluster_name: "edge"
-```
-
-## Customization
-
-### Different Kubeconfig Paths
-```yaml
-- role: kubeconfig-manager
-  vars:
-    cluster_name: "openshift-cluster"
-    kubeconfig_source_path: "/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/localhost.kubeconfig"
-```
-
-### Custom Context Names
-```yaml
-- role: kubeconfig-manager
-  vars:
-    cluster_name: "prod"
-    context_suffix: "system:admin"  # Results in "prod-system:admin"
-```
-
-## Troubleshooting
-
-### Common Issues
-
-1. **Permission Denied**
-   ```bash
-   # Fix ownership
-   sudo chown -R $USER:$USER ~/.kube/
-   ```
-
-2. **Context Not Found**
-   ```bash
-   # List available contexts
-   kubectl config get-contexts
-   
-   # Check if cluster was added
-   kubectl config view
-   ```
-
-3. **Backup Recovery**
-   ```bash
-   # Restore from backup
-   cp ~/.kube/config.backup.1697123456 ~/.kube/config
-   ```
-
-### Debug Mode
-```bash
-# Run with verbose output
-ansible-playbook -vvv playbooks/examples/multi-cluster-kubeconfig.yml
-```
-
-## Benefits for Your Homelab
-
-1. **Consistency**: Same process for all clusters
-2. **Maintainability**: Single role to update/fix
-3. **Scalability**: Easy to add new clusters
-4. **Safety**: Automatic backups and safe merging
-5. **Flexibility**: Works with different Kubernetes distributions
-
-## Next Steps
-
-1. **Test the modular approach** with your FastPass cluster
-2. **Extend to Hub and Internal clusters** using the same pattern
-3. **Create cluster-specific variables** in group_vars if needed
-4. **Add monitoring/validation** tasks to verify kubeconfig health
-
-This modular approach makes your homelab's multi-cluster management much more maintainable and repeatable!

ansible/ansible.cfg

@@ -54,7 +54,7 @@
 
 # (pathspec) Colon-separated paths in which Ansible will search for collections content. Collections must be in nested *subdirectories*, not directly in these directories. For example, if ``COLLECTIONS_PATHS`` includes ``'{{ ANSIBLE_HOME ~ "/collections" }}'``, and you want to add ``my.collection`` to that directory, it must be saved as ``'{{ ANSIBLE_HOME} ~ "/collections/ansible_collections/my/collection" }}'``.
 
-;collections_path=/Users/rblundon/.ansible/collections:/usr/share/ansible/collections
+collections_path=/opt/ansible-collections:/usr/share/ansible/collections
 
 # (boolean) A boolean to enable or disable scanning the sys.path for installed collections.
 ;collections_scan_sys_path=True
@@ -209,7 +209,7 @@ private_key_file=~/.ssh/ansible
 remote_user=wed
 
 # (pathspec) Colon-separated paths in which Ansible will search for Roles.
-;roles_path=/Users/rblundon/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles
+roles_path=./roles
 
 # (string) Set the main callback used to display Ansible output. You can only have one at a time.
 # You can have many other callbacks, but just one can be in charge of stdout.

ansible/create_jarvis_user.yml

@@ -0,0 +1,6 @@
+---
+- name: Create jarvis user and deploy SSH key
+  hosts: all
+  become: true
+  roles:
+    - jarvis_user

ansible/group_vars/all/semaphore.yml

@@ -0,0 +1,154 @@
+---
+# ============================================================================
+# Semaphore configuration-as-code
+# ============================================================================
+# Drives a freshly-deployed Semaphore instance into its desired state via
+# the Semaphore REST API. Idempotent: every object is checked first; only
+# missing ones are created. Existing objects are left alone.
+#
+# Loaded from group_vars/all/semaphore.yml so that the configuration is
+# version-controlled in the homelab repo and survives a wipe-and-redeploy
+# of the Semaphore VM.
+# ============================================================================
+
+# ---------------------------------------------------------------------------
+# API connection (defaults to the local Traefik-fronted service-name URL).
+# Override semaphore_api_url to point at a specific instance if needed.
+# ---------------------------------------------------------------------------
+semaphore_api_url: "https://semaphore.local.mk-labs.cloud/api"
+semaphore_api_validate_certs: true
+semaphore_api_token: "{{ vault_semaphore_api_token }}"
+
+# Feature flag — keeps day1_deploy_semaphore.yml deploy-only by default.
+# Set true to also run the configuration pass.
+semaphore_configure: false
+
+# ---------------------------------------------------------------------------
+# Declarative configuration of the Semaphore instance.
+# ---------------------------------------------------------------------------
+#
+# Top-level shape:
+#
+#   semaphore_config:
+#     project:        single dict — the lab uses one project ("mk-labs")
+#     keys:           list of credentials Semaphore stores
+#     repositories:   git repos Semaphore can clone
+#     inventories:    Ansible inventories from those repos
+#     environments:   env-var bundles
+#     templates:      task templates that tie everything together
+#
+# Each list element has a unique "name" used as the natural identity key.
+# ---------------------------------------------------------------------------
+
+semaphore_config:
+  project:
+    name: mk-labs
+    alert: false
+    max_parallel_tasks: 0  # 0 = unlimited
+
+  keys:
+    # The ansible-vault password. login_password type with empty login
+    # — only the password field is consumed by Semaphore at runtime.
+    - name: ansible-vault-pass
+      type: login_password
+      login: ""
+      password: "{{ vault_ansible_vault_password }}"
+
+    # SSH key for the gitea deploy access (clone the homelab repo).
+    - name: gitea-deploy
+      type: ssh
+      ssh_login: git
+      ssh_private_key: "{{ vault_gitea_deploy_key }}"
+
+    # SSH key for the universal automation account 'wed' — pre-baked in
+    # every mk-labs VM template. This is the canonical user Semaphore
+    # uses to reach the fleet.
+    - name: wed-ssh
+      type: ssh
+      ssh_login: wed
+      ssh_private_key: "{{ vault_wed_ssh_private_key }}"
+
+    # SSH key Semaphore can use to reach the fleet as jarvis (admin
+    # account provisioned by linux-baseline). Retained for jobs that
+    # specifically need jarvis-level access; the default is wed-ssh.
+    - name: jarvis-ssh
+      type: ssh
+      ssh_login: jarvis
+      ssh_private_key: "{{ vault_jarvis_ssh_private_key }}"
+
+  repositories:
+    - name: homelab
+      git_url: "ssh://git@gitea.mk-labs.cloud:2221/rblundon/homelab.git"
+      git_branch: main
+      ssh_key: gitea-deploy
+
+  inventories:
+    - name: production
+      type: file
+      inventory_file: ansible/inventory.yml
+      repository: homelab
+      # wed is the universal automation account pre-baked in every VM
+      # template. Semaphore uses it for fleet-wide jobs.
+      ssh_key: wed-ssh
+      # become_key is Semaphore's sudo PASSWORD slot, not a second SSH
+      # key. wed has passwordless sudo on every host, so reference the
+      # built-in "None" key. (Semaphore rejects an SSH-type key here.)
+      become_key: None
+
+  environments:
+    - name: default
+      env:
+        ANSIBLE_HOST_KEY_CHECKING: "False"
+        ANSIBLE_FORCE_COLOR: "True"
+        # Semaphore runs ansible-playbook from the cloned REPO ROOT (not
+        # from the playbook's directory as I first assumed). Path is
+        # therefore relative to repo root, not playbook dir.
+        ANSIBLE_ROLES_PATH: "ansible/roles"
+        # Collections are installed by the semaphore role into a host-side
+        # directory bind-mounted into the container at this path.
+        ANSIBLE_COLLECTIONS_PATH: "/opt/ansible-collections"
+
+  templates:
+    - name: "day0_linux_baseline"
+      description: "Apply the mk-labs Linux baseline to one or more hosts."
+      app: ansible
+      playbook: ansible/playbooks/day0_linux_baseline.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'
+      survey_vars:
+        - name: target
+          title: "Target host or group"
+          description: "Inventory target (e.g. figment, semaphore_server, all)"
+          required: true
+          type: TextVar
+          default_value: "all"
+
+    - name: "day1_deploy_semaphore"
+      description: "Re-deploy Semaphore + PostgreSQL on figment."
+      app: ansible
+      playbook: ansible/playbooks/day1_deploy_semaphore.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--diff"]'
+
+    - name: "day0_linux_baseline_check"
+      description: "Dry-run the baseline — shows diffs, applies nothing."
+      app: ansible
+      playbook: ansible/playbooks/day0_linux_baseline.yml
+      inventory: production
+      repository: homelab
+      environment: default
+      vault_password: ansible-vault-pass
+      arguments: '["--check","--diff"]'
+      survey_vars:
+        - name: target
+          title: "Target host or group"
+          description: "Inventory target (e.g. figment, semaphore_server, all)"
+          required: true
+          type: TextVar
+          default_value: "all"

ansible/group_vars/all/step_ca.yml

@@ -0,0 +1,4 @@
+---
+step_ca_url: "https://turnstile.local.mk-labs.cloud:9000"
+step_ca_fingerprint: "f63c44e76381e359978bd2dca07c928d04ad44b575f0364fa66b5725c7e7891b"
+step_ca_provisioner_name: "admin"

ansible/group_vars/all/vars

@@ -17,4 +17,31 @@ base_domain: "local.mk-labs.cloud"
 terraform_server: "infra01"
 
 # Traefik variables
-traefik_server: "lightning-lane"
+traefik_server: "lightning-lane"
+
+# ---------------------------------------------------------------------------
+# JARVIS automation account
+# ---------------------------------------------------------------------------
+# Public key for the 'jarvis' user provisioned by the linux-baseline role on
+# every host. Public keys are not secret; the matching private key lives on
+# the JARVIS command centre (carousel-of-progress) and, when needed, in
+# group_vars/all/vault as vault_jarvis_ssh_private_key.
+jarvis_ssh_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5sym5ajFvDyzw395BkHv7qVb66XPTx/OF1p19MGuNo jarvis@mk-labs"
+
+step_ca_principal_mappings:
+  - local_user: wed
+    principals:
+      - ryan.blundon@protonmail.com
+      - ryan.blundon
+      - ryanblundon
+  - local_user: rblundon
+    principals:
+      - ryan.blundon@protonmail.com
+      - ryan.blundon
+      - ryanblundon
+
+# Leviton My Leviton API
+leviton_email: "{{ vault_leviton_email }}"
+leviton_password: "{{ vault_leviton_password }}"
+
+jmri_vnc_password: "{{ vault_jmri_vnc_password }}"

ansible/group_vars/all/vault

@@ -1,170 +1,361 @@
 $ANSIBLE_VAULT;1.1;AES256
-64393362643437353731353234643535366431613861636131613139636435633465306333656161
-3365306632386330373862363637363435633235643336610a663736396537313032336162633334
-32626233346233323565383030393130316532653062373730376163326134616239663865363862
-3365316365643534610a343932623566356637663136336338386534373532383863363662326438
-37393331356632313163643138613330366631643465623633386433663236636334666264383033
-34333935633131363364626333313336353733373562326636343633653838616532643737366435
-36366330633263613938323566393063373233363538643531636131316335316461656631616362
-30343965356363383139366534363664313831363132383337636266316538393139383232386230
-65353364313534333632306465393264386466346365303232356263653563653338306131376131
-66343764643639396663623330623332333466633737343738386230626463386137373536343430
-36636430616132363161303338353033343963643338656639643662636664613965636263366135
-64353134376162633162316166316239333963653930363830646165636537653238623537323238
-39376338636335336338323935333439306534386539336331613961663261623962383237303632
-34326139626366303331363337353432623636626231373731646665623831353865303130663533
-37326639626237653361316666616161363531303961613538636663633063396363346337663239
-64313333653766383736303161636530316538633033323063323662336335666264646564643465
-64396436366131373061326233643562626335376263623031376532313730653363343038356135
-30336131646635636638353934636139343662623265336338386535663536393935343132306335
-33626632613663353661313061623732643539323637336433666330313463666661623836303462
-61383732613139343434363662616539373837633139393764353864613062346237346661633033
-61393639326535366266643664653439383238646132306636656130333733316638363830346433
-38643430346263663639653762393935356662363533323766343362366532626532633530323630
-30643436653130363066373665666434383732663837643839356539366432316539613863623839
-35323930383437383535373330326239663966383234663233643337623330353236626464636530
-36393735646664366235363831656262383333626265383066393363346165656265363438306135
-34633530653837346638636665666162363062663333623263356131646661373234333939333536
-30643639333836373439613561346130623239363737626238663436356365633562366465643561
-32643039376234323963653733353138643138626430383639313765353035646539653466623539
-32366135366266323261333938373837386636626232323661393035613638643335383564663462
-31383663663063373935396439653231353962303630346338623938343064643037396562626637
-63363363343739626639633934393734396434653262373137373539316536306663336466626639
-34646465306439313239323365333761663161313461613766343463666134303036376338366663
-64356364653462383534343438343933623766396232336434653765613864376235363735343032
-32313133383731333366626534363065333738346230393636393938366633363561346436363338
-33393932626333636166313431633339386564616466653165383962656633303161393935366635
-65396464326333396433303966316231376432363335643732303438663131653932636564363264
-36356663623436643835373538363662643134313030656236326335393334626634663136333137
-38363432346663393435366536636335636465343131666562396334636530346235366365396431
-64623739373130623436356161666139656330646661396430633264393632663366353037643130
-35373839373430643065616630613433646536356563353133633361623235623733313234306435
-64356635343361633462376131636362386433373339383365313436333332613333316237323632
-33633362376331323930376130393838633333316330363362396131306230643161373636303034
-37303738306233363937316332313830396336323639333634666364633566386261373031383563
-36633865643634363234613463636437306236376435613034623537356162353235396665636338
-31613733363430313532643235343438393137313136653730643364623662336236323464656465
-65636431633464613437396561643638346565313937303731633837623930333538383335633938
-62666461323033303937653366646432623764653566626333333766656235633662623631636636
-35626161653736303261303233643236393038303063386532643563663065303331616637386661
-33326637393633616430643665623431616336336666383236326538383535633364613135653131
-38383961383264313130383263613763326666663033626338313762376336353866646634323537
-39393565643265633437396535643165626165646537373039613061613936356434366238636562
-61393639316531316564646334663863383836656261623230646461323566316664653965336136
-62353839363664396632306231363031303265343131343739633835353338386335343737326633
-36656433616135653663353166636461623337653138613435646663663939323631373063373136
-63396331313538636437383635643831643935303932313964336532643366623434316662376632
-63666464333736333162373461333563393138366638643039393865613238616531356165346236
-65313432383533353738396530356465386263313939393962333637306138653939646638353235
-37393733333032623763333632353866633866613162663833346534666237383430663838383965
-66663332616164353539323261383364363237383064306132633530326134383561346536346636
-32393365316435626464386631663037663934313533663030313466323134336439303362626365
-30613764346362326130353333353663316539306437376465306332353464343530663933363562
-39646333323631353835336461326233623963353535316633353236353236636462313163633638
-35366538366336663534353739353231306164626664383737333565666337636164386539316632
-64323966336637626538303830323535373533306362636236303065663161353734653633393064
-66353938306238646238313037323163343935643863653632336462363834326634363433383338
-35646364353834376439633136313939393064633539643462623562333832303261386331636533
-37373837396461373064353565353438633938616162363138323561343662383330346633323133
-36626665343636343739353732366133313434623230353732323037633236303237656364323763
-30363530306131303630386131623866323861633636313431376161336536373436656334303036
-61316639666136313338396233326234386634343863633632626264363336376531363461626564
-35336335396561626339616234373265663032353432363832306666353339376338396366383839
-62633063326135323539653133626538613331613334353430623232376336633334666433316638
-61326563366432333632666436363761376237636434356231613061626633303737626531626236
-62373166363432616666616630616565373934356564363266396662323963636434313735626161
-61373738623966363032313632376465356235363834633639663733653131636531363563326662
-62663365323934363761653536356162336463646566393838346134356536303264323065396534
-63346531303764613634646336313530326663373433396436663162343530306131386265303137
-32333432383966363735343331646233613631373165346131323632366165346235656330323939
-34393030313466666265346163323561353734613434386239333630623762616566616562316265
-38633263323339396462336166646431363336616462366463383663313839613638383663303133
-32333835623531366236643530623961656631336139313037353962323937666465343430666336
-33383464363930663630333164636361326334396163376661666564663538623732663839613237
-35623237613761356235383130633733333766333236363537383862306539373665383461386534
-32646432363339306433646139393732366464336339346161323736363937383566656663356230
-65316562383562366366653466646461613235353061623363386331636139386136306131633232
-32326238353861613236373964383131363537653632663532376364336166303662663336623161
-37623838616664376561663763393534323931343163376535396662626333383730363232653036
-39626266623666346635373630343135333532353866363234396265356631333265663432326235
-37346439613363313334633964386632336138316662616661356637363730306164646439643765
-62343137663137633031316665363362643165643731326464323962616330383164353861366462
-31663965626338636534356461366362333831396464376134613331393664306639386632396236
-66633066663831646361333730356361646133383834376230356336613038303665323732663162
-37643130313739306638636262656632353431316531336438363636363833626237346363326461
-31636262396632666335303566633161333937626330373835613236656130383132663863636364
-34383661353966346362386461303062303138626536323163376362326639356336396437333530
-66623765313638616430383838396164336565646338636430363262396636663965383531383139
-35356663363437383132333566336131666139643639663662633363616133323031353032663438
-39393266633639306363313530643239303132303264323063306335346233363233373865653863
-65396430346630626566383963356264313630623336316236393730343437656435656664663266
-32643639363536396266626435373363303234623230383035326536633631633737653739366563
-65653932663539353436366139313635663962663330343461353864323166323733366163653162
-66353866376134633534323366656265633930356132316137616235343866653265666161363266
-30386638343739353965643466613639303666316432323634383464633431363566333831643134
-65363138313439366430613837396337323436636530313664303964353966306565663630323662
-33643639623935336235373332633739306539656235323439343331376632373538613534386430
-30633832656532623262326662376237393262333764623937343232383861636563633730393765
-39663032373132323735633361343933333332623465343863636263363161303165656234313338
-65383462626465376162306639626531366161396531643364656539366233306166386234313761
-30633666303832636561323236373363373137353032613637353637386238353234646431333661
-32313834666237626333626437663562646438363561393364373565313536363535323536363537
-35633834616136656261643130656131306264333131326431626439343765393031313964616639
-33643933653033336436616635346335383335333334343836343638613264396462633530623866
-30303462653130353430663862623261343866383335343239393435633962383864396430313536
-66643535303437383232323564326266356636376464623563636139633237313661356330633931
-66376631373366613731633863666132626366393532666331343361323764626539666238656262
-66356332383235353864303562356638636130343938383530376432663866316238333434616233
-32316432333064663764363831343464326334353737346632383565643737366233396139333639
-35656435346335323030636363356633633332376138653930613037313537373038353433363532
-39346161336261353463656430663033623036396365346638323832313361633866363134396165
-65356632366463393435386366643232383162623536653965643235323934633464373061333237
-32636564386662626365613235333664323563633466383238343336343063376531396161343530
-61306632646133626133343132666534666337336239306137663931623637643164326538646138
-63313037336235316164316232636262316331356363356438653235346539643065636537366661
-37313437386432316336663366633366666434346135356462623635313531333530653866663863
-31646438316435373637303733646564316261336233623035353564363664303437373132353166
-33646534663130356330663565656663333765653961663835623235633665623464353862616138
-37343531366462616439333539306265626164636233616262616563386566396536386264343137
-30396434303231366664656334656635616334633066323062313738363431646335643132626331
-33663038316165626365346366363731323639653837616163653561623034393064303563353232
-30613939353336396365613662393938663933363662656634663465303134393964623738633765
-37633832626631363736383436666263356531366237356261666538303863343033356333656138
-64366537363939346535313732643965623332396265386636353364316630333130643833383331
-34643563386539383235386130323065353835376564613835313934333636316464636463376537
-32363565333038643230656266393761313064616537393830343163643535646436616230626166
-36373531646536363664663330353864636533656261353331316364633361633934326436323933
-39636631623430313934393033373630656132623734363835353735353935393063356261323764
-66346265376339623265376666343865343763393833323564643161613861303065346137653339
-34326432383230656638303963373832316438666131623539613464636631653365353331346262
-37626130343831636133646135323564306538353439636265313239326235343232633136383663
-62306561616564623038393631373862346535366135633836353363323330346430613466393463
-39313766613064306566316561303761626135613063326536363761626635646134303732356130
-38333266363639636565393737323938663938633662653231366164316262666538356162323665
-38383263366133326333636466343835373737613333623464383139343863336234373932393239
-36653736393732353466656334613364626339356533343363353731353033363730376565353236
-66343332306330303662373363326236393333663565383661643763363662396265313037643432
-63343336623663326237326365333565346335346630356439303534363561626362363833313239
-62366436313466633534343430306461313266376363336536666162306135363434643266373338
-65323866323537636465306636646533316466303735386336663234386538303939343661653562
-34353564313738643665636337336536343735336436626438653335376532343137613837356363
-31353861363733373232363865323164663532646235623533336536333932363133613830373937
-38616137646332303934303839633336313239653064626331383432633935353538636132633134
-61393230663536633335393330386363333162636661373938343837323736663539393636366532
-35623637623262373332373335303833373239323430393766633939633665643236623139363834
-30636135303634643765393433393962303138666630343936653234333730336234356234396566
-35346331336639333237323136616337623938666561343861393563393633313261633333333434
-38633064633538396566373730636632346234653339303533343431643266373266633836633139
-33313234366236626338636331346565336138313136623632343735363132623964353066346233
-66363833383432316238353364363963323762666562303030663939303162656261663664616632
-66396466643763393130313831313438356635346230646335306237363262366132323133646535
-30313338653262636136393133306663653331333830626534356536303532633031356435663734
-32383035643637313863653537656665366138333933333364646561353333653661306133646361
-32326535393333383033313765383031353233323138386365623132646636383037633537386361
-65306166613030353033666438343530333330306532323135306363653764613638383461633964
-63666239366638663537643636373432303164623735626634383636643836343436346161393365
-62336462636534383766656632653833333832393263316633356235373335643436363333393335
-62643838303131643265613861373964653464623766363664383330343138653632396365633533
-39383535616630663564326536623537323966616436353439343630363738626131326365656132
-32383737303733623830353366383062313134396531303831323336326137396335353763353631
-36663336353865303562316233643762643563386665393664623138643836633165
+63623430346462366164333638633439646431326632346630383066333138313438643039373630
+6230333230356433343761666335323934656463653737360a376337346163316334333266346639
+30366436623165323462623330633935313438303761343666393162303466373762623235333161
+3835323539376536300a623962323438326336343537316630626262336339353730316162623935
+64666430626164316163633064643263396238353231373438643432343535633966636430386632
+35653437383361373938353034306264633139373663353062363163623634333538623831633831
+64643261376662613763306664353566643462306431643963633261643732386131333565366539
+35663062633730326166616366323865396536363532643931386637626430373562626531376430
+39376634363634656337363038666336663365363562356664333139633833323562386562396166
+33636437346130326539623364343030326330646137653131383739663166666334623566386631
+64616239656662393536633134643163663537626435653561323066336662613536306363623536
+33396466383537613135353930353832653765313435666435313266336361656633356131653766
+30326132366535323638393137633466333337306466333265353635333762613731396663313839
+36363830653032373564306435626333646530656535396362346132663937336337376339633366
+65373630323631303062656339613536303932656135363437633934333764613939343830353432
+34313665666634336465646363356237306562653534613863353064336236343963393664323738
+38653237656534616562303439616332303134626565646261343131393162343433636232393665
+62343431343535646431363861643964643234343665343366363930303663303565636161393033
+63626638333763343139396465363165363632393664623838623065623466336136373333393263
+34316439656232653261653538396231346462653339353034313063633661376266363265636432
+64316336613736396266333937353833363230653132383339626635386563626131663063396633
+36333061396639653238373965613831653935333533386633613035643530376465366331373832
+32643936373630363539666463353839333335663763653530623037326263306636383233613037
+39376266323064633366326163666264393265306438616330613631663137303963353666353231
+30343565633235643731326136643132376135376639366139383466323333333732396231373534
+62366438376232613463653231376164643930356137336337323763633063613861636266666262
+31323934356237373964316531353537366236633162303661663964356464653561333166643432
+61376631653335633264393762636435376535316663333065313638343361366439383432656138
+38353737353865396233366231373439333863386161323532373537333934346431373664633138
+30646437643737663031613332636536313039313663653262633665633564363130643738333031
+33666232333734646531326266393934636430626332356266333461326238633262316364356336
+65326238316336323037633236383765323332633936633062353266623238633738336132383432
+61343432343035386130363462663239613166626661613332393163386232356237383464383762
+31323739643235326264316134306430356539613865353532663133313830303061396339353566
+35373062316237373232616662383663636236353365626665386532333336313864383837383035
+62653638306136316137663738616663636434303533336433373739313331616631343131353265
+37353430386330333562366132393537613465343363623838393165666538623131653164376434
+61376533353366613735626165353562626431313031633238343966623962323231626265366330
+34353165623864343031623565363235323763646638393762646565393465396534343937666335
+62643530643435343931666563396661653662396265303362663932333666383534656539663033
+61663533353333323733613933363433383033346463306430353634633466396564623837346133
+38636131393738636666313765353835343666353663396539623236313237303437666665303966
+38323364376665613731336334383535373835303138373036613665336636306364623464303963
+39393830646133363263653330306531633863333064663466346135316161376362653862313132
+61333830303765386138303865323766353663656531643965356331633532343435633461366333
+61343534613166656639643363333231653738353936393938376665616136626361653432326531
+64633861653738616237313061393132383264313964643764366534303263653233393035363435
+31376164356466323431383836326334616130363264393139316362333130643262643766376331
+35666130303636363666363932616134306665313339323231306666353236353965356332343430
+36636263353565396535383862336464646134346566626635363063613761353333326137646662
+32656535356332626166636432643635353734393564376161316134613561303931663366616366
+35393166393632326564393763366161663636336362303566316162326631663937336437623637
+39613832666462613963643834313932323837393337633735633833646265666666653339353832
+37636332633063636133663938306234316666393735643634303833666537363932323363613466
+37626235626633383639663262653138613038363737323639306234366562666236326332323932
+63323336623633303736306362326237636465666465616361666130363538643135616237316234
+37623562396363326237663665636539346166323566386365376665616236653735646637363939
+64656662353233323065303438306436623735643934613839333133356564363438653133333037
+33656238663733663665373463393038303865613838366538356538383539396262656561353563
+31666333316564336262366435306261613563376462356338613063343232393766653332643237
+34636639333962393663333566643863386261666630393362356138623732323435666534376561
+61366363313861376566316235326633383630316338346333623432303766663130333130303363
+66616336613364666165393964666665383330316232316465663561613239386434663135613231
+62623334383433373461383037343037663236646463393632636161336562663533636235663039
+65383330373039386361633363613035636135373765353331636139313838353231353731346336
+63323736636130383962363762343437383237373533396433343464383235393030373862346233
+36646238623165353264323162316362376338383463663664636132373963623938373537373037
+30353262626363666565386536626163393130306634343836663137653537393066333637313639
+31376336373565313630636436616635623633396333313036366530613630663332323134613961
+36666438656636626561303637646539656166373861626232663266386533376531346166653834
+34656530363464343131303666616237373030393863326132313764373966633365313834316438
+34396239613235623233373136313464626661303666303438613337366662306363636439613332
+33626635613039363864343233323930333731376665346138626363396336373862636565613061
+30613863356637396133656663653232366265373766636237356539623639333133346361363361
+63343639353734313163346333356138343237383238623733343331376631636632373231363834
+62626432303732663435353762346161363330373266353031633862366539333133313931396166
+38373330323661616366343063363437333436626438376665333866376338626232383735613434
+64656363633332646533376535326566336566306439373835363264373335306564616337383465
+38353966636434653064326265643933653661363439363334383537623563303066346133353431
+62343662646434633761653332323430636339303666646262636334316461383865366436383231
+61313133316332363337343963306431356231306534636231643539383733383265303662373430
+34626666333830353934626139663532663332353938393038303631633335636236393133623064
+37306337386464656339383261323464303934373337333235343635326164653762613838333030
+39653063316131616566613365383961383435636639616536316662333736396238376661386533
+34643833323164303930656165396235353531326535313165663361653939656263633638633337
+36353435613335633239316435313965613439663061313834356661376365653763323837643561
+34333833626663353438623161366537326336646630613536653831306664663636343963313165
+65323332353633323931346634336331636465396337393035613834633962343662393930646337
+36346330353031636633326532616362646465386633363333613134653261323234636539633734
+63343965356433366233646536326333313366366537343934383239383439393633396461633166
+65633439336462363061316435396235346366386335666233343963383163393465633766643731
+62326362613266653238356435633032373036623839306132333136653537306365626165616638
+64316134316134393463313165376536383031366132363831333432323466653538376433333033
+65366438353935613863356562666264643063623439383335396531613730353861313664663234
+36626533366134643164353138306234333765623634316533383264303636353039643130366433
+38313133333632663666303862323939633463633634653963323866376137376137633930313963
+61336431656332333636373638316237663861336136393036653636366566316661303034623566
+31323537356338363762643265613534316466386263666236633038386634333139636561656331
+63613636316439393435383931306530306163386266373161666139373235653935393632313261
+36343066653561363333363830313136653538366639333464376562316334343839363332643137
+39336463613631346161616534613933613234656435383234313831366366643961393633633035
+39663935626134626138383038636266356434393535353165626632633430313635623532646165
+31363166373335326433363336326662663561306166313862373161633739643662376461346266
+61663730366337376165653033353466653761613938366532653633363530616134393464303138
+66353637623135626431643835613239633033386433663735356264333734613162343234633566
+64643039616137393863396433353138373862646138633838356365373863623235376638383439
+36373732373031346132363738383635653865346637626233663537613636613862323666616438
+34333336346235636234653062613466376637623165336337643933623535353033383438646530
+36653133336637346432343136336331336464633439383938353862323365343864666533316633
+66646262343534373165366266656135666339633333626133643238386139353537353866616631
+38306335663165363138303635383164303535386536626431663661396664376433656339373934
+38396130313438653539393263323265646163633939653431393035356332336664396234383636
+32323863366237633462316536626639343335626131323536373364393266386163633433356263
+36366665373432313132363761383632343532306361346134313464653763393533613565363839
+62623938346530636562383937393534653963636365303837336165343361313734303666623739
+30653834616163636538313038636261343434326164616264356261336239313039373661396535
+34346631643337666234373933383362656266346266393035363332303636363035656538636363
+39396466353565346264353663316562623239373564616162326439383334663730326435353236
+37366238653131356339306566326534616561653637613438666430336334323031373661353636
+64356131343763653639313531303866636334326637313838623138303836666466623736623237
+39363838653431323665366634303632666337363663386261326538313635313638383764383765
+34363832366135333436303635373761653265653165316135633135373365346266356635663533
+37303134613131653563356662363965353234643765373438313835343063313931626464636562
+36313434356434656138616433666266353538306666333363363431356530313262356438623537
+33303365393061393161626665316332626238353438623466373831303939663734663038346462
+39323462663732653335373261306635303231636563373465343761613262396466623135323736
+61316638313535653031633230333638343737633163636335343864336336373437643131643335
+63653766623436323039303065646162626331336637346237656132353039623063396631666535
+36316634623034326664313766326464383337663230643530623563326333336232666334323139
+33346563353734346338333432366437353665323764366335336232353163373563326265346234
+36383437383332366234393636323034376434336461336532613663316533653463633263343261
+62333535653062663663313534303237386562623533636230626531646461613233653330386466
+32623137633136323363386232393466303537643331656464663234636336393532313831313961
+37623939323963643364636439663032386630336235623037643065356631376637333062313762
+31653661316562643633643135616634353631623463353637616131343531633266393766336232
+30616138616437323138383732306537326562666239636561383631333534633937396463613765
+62313064653838623537393839386464653539326132393732393131633335393063393636376235
+64306566343762626238386632626136396331336564326361303835613732623531396631363564
+32616631333034313563396532396564663262613733626362663632333938336331633664376638
+34626466613239353935376230653732366236643830353963653662613338616631346561623063
+61616565393965613730326530353935323432306465656464626238623438636263666530336531
+64333864636131343566643164653934306135316437383738323738616362643636383761383433
+65353762663930636366376365623535333636613766666465316134303131623637343864643461
+33663934656631333032353734333361363339336266343631363937306632323635663832643266
+30383633323735333430376662663765303561643563383466333764636131363732636134376462
+37646564386564373038393135653761373937313039623737623938363631393632346565326166
+64376637323432303865366436356264633066343466333838303164373234646661346133646561
+62383838336461306638383266373462326165313161383832316462363835366361386663353935
+35616433393963613363333965666138363365666366646163336163613237386263343737636335
+36623864346566383632643035393361616533396538356562343364386330336636383433303538
+65653630303435373336366639656137386363303439333164633634323730393337333764633461
+32396161303864333362663466303161366465386338396332333462366339353461373638343961
+31343466663537636330663962636431366235646164643332343433393063633435646565333863
+37626239396264653434363538623133366561623436633739646335383534323839663465316339
+63653731636266343130383035323962333062623730343033613663366431386366623038373238
+32666537323237336236386135626339363861636439346664376561666538636532396562333435
+32383366373437303765653664396436623861333164396563623639636131656366316138396131
+61316432663239346539343261363461643632363432653161383233643431303034353136396465
+35623836393435396234336261626162326433356134636139303261653430363835333364656161
+34326533613636366134633332393064356535373432666165386163613961613539333932643963
+32343639343931623366633764363966636164323933623734333935613462303466656439306331
+36323261623639303164646435346533353966616138326230363739303063323366323964356534
+30316534656364373633663464366161373566626639363963356131353936333366326334663438
+32646463653664656635353564323230343763303538316135643838363134393634363031646530
+37323838386134316136663139626262396239643263353432613162666235616133623937383261
+31353138396238313066643964633536636337386238616637383561383563313936373538616334
+62363233623738613064313762303463303266346538333937343566343936326363323037623032
+30346434366661643930623761666134366132373936336630623963636331653532363765363263
+66306133303634343231386164343131333234376662313663393130326664386262363035353565
+37633863353935363635303039333662366462383235636564313666333162666563376666633966
+34666130613034393439346337383862643231666632663463393330356263646165316266613936
+62303536333339303431373531303065613865633339303264323137323732653036333366373664
+64623330313464356461376662663266333430633161393437363862633564396263353333316662
+64636262333832646135626534363737656336663562333365666631646261303665333964326337
+35643964386362323161666464363037623266386539383732626230303830303662366161653063
+36383539626334376238663539336637343033343037346136383733316265383430396133336139
+64616135623230613531313733626537366430626262623836386432363561626238303132613830
+36323533656164376334643436373730653531396236633933393663656435656566626165626164
+39366465646535383532616466313665333533386230656631343332376166613033343364393361
+62656237316466663131333661333565643335646166333332393263626463633639306264656666
+36343330666462373061363466636233333165663662393933343763633333373161626235363138
+64346433663661636561613636366662376562363638356231646438653532633434623132306330
+65656433353262623661636263393737623337316535326332373861393331626563326434383266
+65383931393032376137623833303031303934636135373135626562396364383635623661303431
+65623132393961396336363763616366633064366331316330396130373239336137373964356136
+37653162383030653736626564343739383030636531346534386639313063323938363236306537
+36646132626138643462636466656363353436633863613165613362616264613434303936633661
+38376661306439313036333431363664616662646533333963656165393939303865616661313864
+65656338633864663665303961613165386335646661343438333730313138616535363164336463
+35363563356362396265333334393964356534613763656362323631363237656438653962316336
+62633330616530376537333961383461323432303161343136326363313137333333323835313065
+64666132356632613365393137363061363165623733353534303638353432393739346164346535
+39363464313239386564336436663339303535336633666364373436666635613638643061316235
+61656266623934633339643063306363633131373335333538643338666339396166626262646434
+65623962396464343532366639393339306237653633623763333165303636613834333531306235
+36636430633864396236363638393165653431313139343966316561663138313761653630623436
+33363037303334383363646337303065343239343537343737616438613165323965333334613234
+62623931343365336230343037346230366134396435383236643931366631326335626431306366
+31646339323562653737303465353738343939623037616666656432313833653233373636326130
+30613434646237306636396239363439383961376539613131333164373333313131343062366638
+34333963313163303239333439393765386234313534303834636637393965323439366235613666
+65316336393335656332626165643261316464383232396136336238656662336132646366373263
+65396534353764616134663964376135623035316432623939376231373731343136313265323862
+61646238353761646434313430663362633066663763623735343730633036333533356339393665
+30313763346166653738636234663232323033636332373861373164393737353962323066363238
+34613066323862353831653438633564633561653034356263663430366432643663633836653764
+63333964663765353135636234323330623130633736653263336238396631356436346361366463
+65393239356432386163396135663161626664626137353465333733626635373537396137353437
+64626139393164313866616132386132303837303437306365336164383265346361383661323130
+62396333333666613538363332323032653037646563396436613166323166323666363934333064
+66356665306465653661323331376337653561613761643765666636396531663930333634316230
+35343733613638626230623464663133343432663764663864343363376339333566633963326630
+36313264636638396566623334333230363137353262346531623138656364653038373034353137
+31383533303234636333346332343333336531326363636161623764333762653835396632366436
+31646566363334633336366231363163643837633564363162656130323331626464333236303637
+31663439636234623534336535393835653838643430356364353762613966346461313032353939
+38613932386564623935363135663462626663313130663737373234316231343461616133626264
+31356163363234383132373730663436333738633562336435383532366138653764306165643863
+36383362633137643931333735333264656666336363663161643862323337613536383034336462
+35333165386332366436666439323236346539366530383136626637363539656230336637333432
+35336235363065306534643762346263393935333238383533646331653332643234386539653230
+30376237666166323638303465373737383031373864373266306537373335356139646230656264
+36316536363738323362643230363064363965636563346165356565643265353332386136346435
+66313937346164313661656364373465656230613261333833323335653133396132356334353237
+61353832373063666331646664623565353030663530636135336365633366623533653462386237
+65373462336538663835303831313336396638646534343839343933383032646664306434613230
+38323333666165363662376430356435363463303936396234313931303734666333376431376562
+65636132636435396562376637396464356165363937613435626235303730636239626465306237
+62613335396161303737396231666536353230656533653239353364623733623131333861626637
+64306437633564623565333664653030366166663835353063316631393864663338656663633736
+31346166656636396565333663353562613032373462366433323266396135363430623139373963
+32393864646438326366343036386231353530356233393539646562643339643366346563393162
+39393830646565326666333063396531356336653162623465313365616564653430663264363164
+62306562313037646466366463396432373536303631653338343133393262663865636133343464
+61383237386164633536663230346461383861626666623562313737373138633239333266366132
+32306135313464363461653363636462366662393938396566333661306366383838636438353738
+32356666613238356135353536656130346134663666346362353735613338666234626538373139
+65613262636233366532323630613438663334616164656166623236353531303835326266343663
+66366364333437373039306634383737663963373663366131396566613030386661656235616662
+35663533623864303431343631386362623036343135663665383039333363336534613063313534
+61373939306536376337303561373030343337326437393636366166376630346430666539646266
+34616435346139313033353130303639393530373662616432343330653762393339396432643935
+65313638383330613464363666633965393035643037626162616339306563646130306566613064
+35656130653035363163323831323730633236633736663965653833623131383037323736663066
+35343235356164623038643230373666366265363437396231613365303935366135636135613265
+31393163323837663332623636316462656338646566363361333863336365373562666434366530
+37626236343731313065353037346437356264363233363638393238373063386530646434663564
+35353562396564316535663436376335393136613338643864323132326431633066373462323330
+36306263646434333532316365613239376237303232383531343238623833626363346437386235
+66666565656635306162646430393738666132633065376330393162633066333534383561353336
+33313162666664613636303962656438626133373137336639356133363563653431646461313538
+37316433663263333536386632646536616564316362363238626231613162383966333063636132
+31623436346138613030396462626663616233326662663634633765643864373262393634353937
+32376437363737616337373333313832373135313535666430386536303236356563613166366332
+65323332626363663535633234323364663838333862643232376237653031303137303136633462
+32356431306534626135353462643736373939666130623732303562393932636231373534626132
+32343464353538356231303535396365633465333230353261346533333063303135303135393465
+34656333613966663966646162386633333830323234613836633236626134316162663139656530
+63623666313138666130326139386636646230353637353561323736656437616438633839613837
+62353931313562383830393433313232653461363436353064653039313738396138333263633965
+32316236363233613831303436323835616332646262343336353037323362313265336634393261
+35393761396537373636313665373830326463643136303961316238336238623466396334343664
+61396234663862343937633131623939306135646231373633653534353363383439656539333331
+30303536353462666433626236343163653139333038656662666664626439613639636564393835
+30363165616263656535303439636563643663633434613665613339313162363234623131306630
+34653932376634363264343335343064343838626464666661313533383534383833633863386463
+37633664396537363735353161346238656336396565383637313230636561626362656232333036
+32386538623063613331623662666531626362616430386335333664646234613965643733656236
+31303766326536326461353632353730303434333866353730383562383533623338626232346330
+64396163613663363562633635656566313263383262656666393537653233363166656335653034
+32376335623633373431376266663036616635343231663963363936353137376263656133623735
+65656435393733613762376638613034643466313632646431656461313362363561623463393238
+34373830373633373835376234366532363763316632613766366161613130633762313839386363
+61396632333533663964373463323464323035386236376364646332663431383039623830333137
+62313062393236363338616433613033306563323264316332366161346235356539323232653931
+66313862383935316235653663336666666339343534376336336138366639633538643937303665
+39386262306566386464363337336130633038633837663166333639343161373234303230306338
+30323063393365336332663531316365356531386365343836656437613337346666653637633639
+38653465393236633962373739323331623565643938373563376364333863343030333136333863
+64663132336165616462336232323865636630373533643063383730626565666337636539373136
+32333861656163646332323239653364326163613361373435323966323964313831663138353063
+34653131383463623965386365326531616265653837363462653037386633376361383639656163
+39663338383939323535366135396465656333323331386462353630396237396261316137386165
+38383664613165356535356632376138623233386266336665386330376539373963323162613336
+62396364373031656238356163656464616430316131386537356236663536366461326462373236
+62396363303861303533643438343765356437326663316239613939386134333830303739386464
+63623834366565366163383533393532383061646163666133396136643462376537393935613039
+37623134313439393737626664663637343365373563376261666133346332373033613335316164
+39313733653931383665663238303532353165613131323731306362666138643737346337623064
+34666261323664363864373061666233613163336633383837323766386137323431626337623562
+36336234656635633830366635363463313439646165353261323030323261633737346664373738
+39633836366133633635303638366134393435393663366664623837336164323630353739333462
+36366663643931653230653562326633353637383564623266313936656239393535646131373261
+61356661663534393166383530373739343834313136663366316237333464326563336636656232
+66373035623866383931393238666132386331356530616535313164366466353563653865663832
+39353364396366663462366333306135343065373532663330643435336239353435303762326132
+65343630343532656638653462383266383937663466633034373661643862663933333838653032
+33656261396638666334626366356362623663613461303936323130353436363536663638383162
+63663931313335666435616561353266376134633132633233356435313137653132373935613931
+36623461396139633439396332393037616361316562613137646466613330653234656535623230
+66306434653462633834643036656263376366623835653163326461313831633934366663646566
+65393966373466326137353261383763346666386337666130646133643666656464616438383038
+31306130356238366261616231363933666162373639363463303962303833626135366666303962
+33316161343936393634303964396566653963333237393631353938386262623739393432383339
+37653430336265323133363937303362343336373230633333323764346139326662343434396566
+66383035613262366430303636323236663937393933646566373838383562316334633836633737
+65346537353439306363633431396338396632336565386434363530346365333765363930613063
+65333166393136633665663539656331663037353138366239383332373363366562613237373234
+64303963666462323330653364396464383464666434343831313338633764636337363761616337
+63313462303339643364383361376364366232326361613137326135333263313964616634383464
+61333539373962653338313835656632663261363766346535323735633437323736323632343434
+61643662613261613835366331303439313062313033623065323262356466656533623735643235
+61643332363333363032326434363065303566616661386261386165383066306161376531356334
+63323634356566333065383763333965613366656661313931386532623963383265613131666231
+61363465343462313531313464323731356637393061663133336665363965653035333030383062
+33653335363536656333333738356437316332313361633136396535643836633035303830323232
+65633761333135633739323061613436386166383762353564326430363965623461306235386132
+66366632643763306338373064613935643630616661353233663834396331643130396465636534
+33303830383139343836633163313737313738636365346639396162343561383965323636306466
+63343038363330313363663566656464383264326538303466323862663463353930376165326466
+66383630376465376139646562633065383434333365376362643038643064656364363538356661
+35303432646332623337353465656362656234333465383663353735663537643630616266383763
+30363239363132333166363563376665633936656535663164656532393666336265393964636333
+35323539383835366162326362333537363666386162376561373464323630303032613037636636
+37663135623933643938396635323763353931336531313732636530643865663430646530666465
+34383962353137366431633530376134323635336433653361316363316132383834663030393666
+66303935343839303337636630313138336239393062666265646163386332376536336439616463
+66316165393963333235353931326461626130306435373061626233616430343064303537373839
+63396464306164613863333434373063396534623739373730303135626639663731366666343733
+32313862306431626231373963396461656637313364343661663235323237316432353762383330
+32353736643766323964643035653661363532336261353334363936333766613739623638333861
+30343933613161643862623263623838623866356534323362623838656133663363353366633764
+38323931346630616664316365363463653637663762633138323230356263636634396165613337
+32656666363137623833366561643563613938623565636132313539383130633637313236333365
+32623663333164653733643063396230313033323636323164643534376333346637636436303935
+34346539663366623137326133383533396535376131626631326463323866353363656636313538
+33393731356632313263663533633762313534346435326533346635356162326466316662323230
+62376666666339623638356138353461313431333366633833323836313338643333366161306139
+35383163373139636137356235656564303666346531663663326134656165616435616163323361
+61346131613666653431656464353636303663653934393835373332663432303762393538616465
+63363566396464333861386135336132623539626432383762313762316135623566373937643532
+64653934383662663263303833383034366436613138373863316334376564616235313462363637
+62313166623261626537323631626432393033626233353137366262613134333565666666326332
+62616662653334323535373235616433653233336265343661363765623066363762353836666364
+35373865363165363234333038323437313561646338343930316661633365623938623665623434
+66383562653564623732356130326138346236343766306535386362373664623162393833656230
+35643535353238336361646534313133303835363837353966326538313161353737363939633961
+39626137366133373536326535613362313866303232396233313263363736646139366363303463
+65363266323565303733613065366237636233306137346233333839646438623038343764346462
+35306434336363333562356566636335613263643738313766636534316232653137346166363932
+32386336653265663665623736663330623036323762623562346164373631313533396437613438
+63373632633731333361366462653466346338366139353632616661626630306633363061373937
+36386635653537346535363030326566366165393839653534383065336638303862373366633263
+33633461663764356330333534373036343565313335363731646432323931613737353231636435
+38626361393264363039303831633535643366636365656538343763646538336138623961303064
+31343431616337316661313935333735613662383235663730373632336333346338623432623731
+39303261326363656638333165646661333735316130363234343661393463346132333333633533
+36393635396234623065626463646536633139333662396635303537653338313532313062653339
+65656639646364346265386361623330333666326338386334376366306339653230633334373438
+36333735393664626136

ansible/group_vars/fastpass/vars

@@ -1,66 +0,0 @@
----
-# FastPass Kubernetes Cluster Variables
-
-# Cluster Configuration
-cluster_name: "fastpass"
-kubernetes_version: "1.33"
-pod_network_cidr: "10.244.0.0/16"
-service_cidr: "10.96.0.0/12"
-
-# Control Plane Configuration
-control_plane_endpoint: "{{ cluster_name}}.{{ base_domain}}"
-control_plane_port: "6443"
-
-# CNI Configuration
-cni_plugin: "calico"
-calico_version: "v3.30.3"
-
-# Node Labels and Taints
-node_labels:
-  zone:
-    # Control Plane nodes (masters) - no zone labels needed
-    # space-mountain: (control plane - no zone label)
-    # big-thunder-mountain: (control plane - no zone label)
-    # splash-mountain: (control plane - no zone label)
-    
-    # Worker nodes
-    haunted-mansion: "backstage"      # Internal/backstage workloads
-    peter-pans-flight: "backstage"    # Internal/backstage workloads
-    # Future node: "on-stage"         # External/on-stage workloads (future)
-  
-  environment: "production"
-  cluster: "fastpass"
-
-# System Configuration
-selinux_mode: "permissive"
-firewall_enabled: false
-
-# Container Runtime
-container_runtime: "containerd"
-containerd_version: "latest"
-
-# Repository Configuration
-kubernetes_repo_url: "https://pkgs.k8s.io/core:/stable:/v1.33/rpm/"
-containerd_repo_url: "https://download.docker.com/linux/fedora/docker-ce.repo"
-
-# Validation
-preflight_checks: true
-validate_cluster: true
-
-# Kubeconfig Configuration
-kubeconfig_path: "{{ lookup('env', 'HOME') }}/.kube/config"
-
-# Hostname Configuration for Kubernetes
-# Override hostnames to remove dots for Kubernetes compatibility
-kubernetes_hostnames:
-  space-mountain: "space-mountain"
-  big-thunder-mountain: "big-thunder-mountain"
-  splash-mountain: "splash-mountain"
-  haunted-mansion: "haunted-mansion"
-  peter-pans-flight: "peter-pans-flight"
-
-# Generic Kubernetes Prerequisites Configuration
-configure_firewall: true
-configure_ntp: true
-selinux_state: "permissive"
-disable_swap: true 

ansible/group_vars/freeipa/vars

@@ -1,3 +0,0 @@
----
-#freeipa_user: "admin"
-#freeipa_password: "{{ vault_freeipa_password }}"

ansible/group_vars/hub_cluster/vars

@@ -1,51 +0,0 @@
-# file: group_vars/hub_cluster/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Name of the OpenShift Cluster
-
-cluster_name: "hub"
-
-# Version of OpenShift to install.  All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
-
-cluster_version: "4.18.21"
-
-# Type of cluster. 
-# - none (Single Node Cluster)
-# - baremetal (Traditional and Compact Cluster)
-
-platform_type: "none"
-
-# Number of nodes to deploy
-# - Master: 1; Worker 0 (Single Node Cluster)
-# - Master: 3; Worker 0 (Compact Cluster)
-# - Master: 3; Worker 1-3 (Traditional Cluster)
-
-master_node_count: 1
-worker_node_count: 0
-
-# Subnet that cluster nodes will reside on.
-
-machine_network: "10.1.71.0/24"
-
-# OpenShift API IP Address (Reference host IP address for Single Node Cluster)
-
-api_address: "{{ ip_address }}" # "10.1.71.10"
-
-# OpenShift Apps Wildcard IP Address (Reference host IP address for Single Node Cluster)
-
-app_address: "{{ ip_address }}" # "10.1.71.10"
-
-# These are internal networks to the cluster and should not need to be changed.
-
-cluster_network: "10.128.0.0/14"
-cluster_network_host_prefix: 23
-service_network: "172.30.0.0/16"
-
-# Static Variables
-
-openshift_installer_file: "openshift-install-linux.tar.gz"
-openshift_client_file: "openshift-client-linux.tar.gz"
-openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
-openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

ansible/group_vars/internal_cluster/vars

@@ -1,51 +0,0 @@
-# file: group_vars/internal_cluster/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Name of the OpenShift Cluster
-
-cluster_name: "openshift"
-
-# Version of OpenShift to install.  All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
-
-cluster_version: "4.18.21"
-
-# Type of cluster. 
-# - none (Single Node Cluster)
-# - baremetal (Traditional and Compact Cluster)
-
-platform_type: "baremetal"
-
-# Number of nodes to deploy
-# - Master: 1; Worker 0 (Single Node Cluster)
-# - Master: 3; Worker 0 (Compact Cluster)
-# - Master: 3; Worker 1-3 (Traditional Cluster)
-
-master_node_count: 3
-worker_node_count: 1
-
-# Subnet that cluster nodes will reside on.
-
-machine_network: "10.1.71.0/24"
-
-# OpenShift API IP Address
-
-api_address: "10.1.71.69"
-
-# OpenShift Apps Wildcard IP Address (These will be the same in a Single Node Cluster)
-
-app_address: "10.1.71.60"
-
-# These are internal networks to the cluster and should not need to be changed.
-
-cluster_network: "10.128.0.0/14"
-cluster_network_host_prefix: 23
-service_network: "172.30.0.0/16"
-
-# Static Variables
-
-openshift_installer_file: "openshift-install-linux.tar.gz"
-openshift_client_file: "openshift-client-linux.tar.gz"
-openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
-openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

ansible/group_vars/ipaserver/main.yml

@@ -1,14 +0,0 @@
----
-ipaadmin_password: "{{ vault_ipaadmin_password }}"
-ipadm_password: "{{ vault_ipadm_password }}"
-ipaserver_domain: int.mk-labs.cloud
-ipaserver_realm: INT.MK-LABS.CLOUD
-ipaserver_setup_firewalld: true
-ipaserver_setup_dns: true
-ipaserver_forwarders: 1.1.1.1,1.0.0.1
-ipaserver_random_serial_numbers: true
-#dns_ip_addresses: "{{ ansible_hostname }}"
-#dns_reverse_zones:
-#domain: int.mk-labs.cloud
-forwarders: 1.1.1.1,1.0.0.1
-#hostname: "{{ hostname }}"

ansible/group_vars/ipaserver/vars

@@ -1,4 +0,0 @@
----
-#freeipa_user: "admin"
-ipaadmin_password: "{{ vault_freeipa_password }}"
-ipaserver_domain: "int.mk-labs.cloud"

ansible/group_vars/matchbox_server/vars

@@ -1,9 +0,0 @@
----
-# Variables for Matchbox
-assets: "/var/lib/matchbox/assets"
-http_endpoint: "http://matchbox.int.mk-labs.cloud:8080"
-rpc_endpoint: "matchbox.int.mk-labs.cloud:8081"
-
-# Variables for OpenShift Installer
-#openshift_installer_pull_secret: "{{ vault_pull_secret }}"
-#openshift_installer_ssh_key: "{{ vault_ssh_key }}"

ansible/group_vars/openshift_cluster_template/vars

@@ -1,54 +0,0 @@
-# file: group_vars/openshift_cluster_template/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-# Name of the OpenShift Cluster
-
-cluster_name: "openshift"
-
-# Version of OpenShift to install.  All available versions can be found at: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/
-
-cluster_version: "4.18.21"
-
-# Type of cluster. 
-# - none (Single Node Cluster)
-# - baremetal (Traditional and Compact Cluster)
-
-platform_type: "baremetal"
-
-# Number of nodes to deploy
-# - Master: 1; Worker 0 (Single Node Cluster)
-# - Master: 3; Worker 0 (Compact Cluster)
-# - Master: 3; Worker 1-3 (Traditional Cluster)
-
-master_node_count: 3
-worker_node_count: 1
-
-# Subnet that cluster nodes will reside on.
-
-machine_network: "10.1.71.0/24"
-
-# OpenShift API IP Address (Comment out for Single Node Cluster)
-
-api_address: "10.1.71.69"
-
-# OpenShift Apps Wildcard IP Address (Comment out for Single Node Cluster)
-
-app_address: "10.1.71.60"
-
-# These are internal networks to the cluster and should not need to be changed.
-
-cluster_network: "10.128.0.0/14"
-cluster_network_host_prefix: 23
-service_network: "172.30.0.0/16"
-
-# Static Variables
-
-openshift_installer_file: "openshift-install-linux.tar.gz"
-openshift_client_file: "openshift-client-linux.tar.gz"
-openshift_installer_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_installer_file }}"
-openshift_client_download_url: "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/{{ cluster_version }}/{{ openshift_client_file }}"

ansible/group_vars/prometheus_server/vars

@@ -1,34 +0,0 @@
-# file: group_vars/prometheus_server/vars
-# Ansible vars template for Prometheus nodes created via Ansible\.
-
-# Version of Prometheus to install.  All available versions can be found at: https://prometheus.io/download/
-
-#prometheus_version: "3.5.0"
-#alertmanager_version: "0.28.1"
-
-# prometheus_nodes:
-# #  - '192.168.1.207'  # Worker node IP
-#   - cinderella-castle  # Master node IP 
-#   - 10.1.71.21
-#   - cinderella-castle.local.mk-labs.cloud
-
-# Static Variables
-# prometheus_installer_file: "prometheus-{{ prometheus_version }}.linux-amd64.tar.gz"
-# prometheus_installer_download_url: "https://github.com/prometheus/prometheus/releases/download/v{{ prometheus_version }}/{{ prometheus_installer_file }}"
-
-# Grafana Variables
-
-#grafana_port: "3000"
-#grafana_url: "{{ inventory_hostname }}.{{ base_domain }}:3000"
-
-# prometheus_targets:
-#   node:
-#   - targets:
-#     - localhost:9100
-#     labels:
-#       env: mk-labs
-
-grafana_ini:
-  security:
-    admin_user: admin
-    admin_password: admin

ansible/group_vars/proxmox/oidc.yml

@@ -0,0 +1,19 @@
+---
+# ansible/group_vars/proxmox/oidc.yml
+#
+# Proxmox OIDC configuration for Authentik integration.
+# Client credentials come from vault.yml.
+
+proxmox_oidc_realm_name: "authentik"
+proxmox_oidc_issuer_url: "https://authentik.local.mk-labs.cloud/application/o/proxmox/"
+proxmox_oidc_username_claim: "username"
+proxmox_oidc_scopes: "openid email profile"
+proxmox_oidc_autocreate: true
+proxmox_oidc_default_realm: false
+proxmox_oidc_comment: "Authentik SSO"
+
+# ACL entries - grant your Authentik user admin access
+proxmox_oidc_acl_entries:
+  - path: "/"
+    user: "rblundon@authentik"
+    role: "Administrator"

ansible/group_vars/proxmox/vault

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+64613361376364346139313833613465663361336634326430393261366630306466363935613139
+3634363235343736643230623865386436333734663531310a343965396534336262356234623966
+39353332626662636666383935383530613139626439373664323063633063316264383331646533
+3366333837613731310a656462633638376432326365343135373863313665346566383933353630
+37303565323630633739396433323165326262363863386233343134636236646366633765616432
+33633165613239653762343935386637393437386431383961306436373765343736313634333933
+30376463646464303066613561613564353938306664373464333966383664383034616439343735
+38363966323366343465393530383736393364373361326234356365363163356632393834393464
+39393530356235383830323065636535383138353864373237333164323436623737383435313261
+64366362626232386438376131633533633162356432613835656465623762633464353936303236
+63353633633262633461353963653534663336396134373435303266386162393965343165303335
+65313436666334383965373837376664323861376162373834363439653539383231346634633737
+30626431373739633930313937643938343165383536373465613535366562313439396533643864
+36323032316131333962373732306334373939333363386564653465303261393337333466316130
+32326533353165393635393130396164636363623937313566343333386562616662383038613565
+35386638383365633362

ansible/group_vars/unbound_servers/vars.yml

@@ -1,77 +0,0 @@
----
-# Variables for Unbound https://github.com/aruhier/ansible-role-unbound
-
-### Server ###
-
-unbound_chroot: '""'
-unbound_num_threads: 2
-unbound_interfaces:
-  - "{{ ip_address }}"
-#unbound_do_ip4: "yes"
-unbound_do_ip6: "no"
-#unbound_do_udp: "yes"
-#unbound_do_tcp: "yes"
-
-# list of strings, as the order impact how policies are interpreted
-unbound_outgoing_policies: []
-
-unbound_access_control:
-  - '192.168.1.0/24 allow'
-  - '192.168.3.0/24 allow'
-  - '192.168.5.0/24 allow'
-  - '192.168.10.0/24 allow'
-  - '10.1.71.0/24 allow'
-  
-unbound_access_control_tag: []
-unbound_access_control_tag_action: []
-unbound_access_control_tag_data: []
-unbound_access_control_view: []
-
-unbound_private_addresses:
-  - '192.168.1.0/24'
-  - '192.168.3.0/24'
-  - '192.168.5.0/24'
-  - '192.168.10.0/24'
-  - '10.1.71.0/24'
-
-unbound_private_domains:
-  - 'mk-labs.cloud'
-
-unbound_domains_insecure: []
-unbound_do_not_query_addresses: []
-unbound_local_zones: []
-unbound_local_datas: []
-unbound_local_data_ptrs: []
-unbound_local_zone_tags: []
-unbound_local_zone_overrides: []
-
-unbound_trust_anchors: []
-unbound_trusted_keys_files: []
-
-### Remote Control ###
-
-unbound_control_enable: "no"
-unbound_control_interface: []
-
-### Stub, forward zones and others ###
-
-unbound_rpz_zones: []  # list of dicts
-unbound_stub_zones: []  # list of dicts
-unbound_forward_zones:
-  - name: 'int.mk-labs.cloud'
-    forward-addr:
-      - '10.1.71.5'
-  - name: '.'
-    forward-addr:
-      - '1.0.0.1@53#one.one.one.one'
-      - '1.1.1.1@53#one.one.one.one'
-
-# For stub and forward zones, if a key inside one of the dict is an iterable,
-# it will iterate inside it to duplicate the option with all the contained
-# values.
-# Can be useful in case of multiple forward-addr for a same zone:
-#   Example:
-#     unbound_forward_zones:
-#       - {name: "test.tld", "forward-addr": ["192.0.2.5", "192.0.2.6"]}
-
-unbound_views: []  # list of strings, as options can be multiples

ansible/host_vars/astro-orbiter/vars.yml

@@ -0,0 +1,25 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/host_vars/astro_orbiter/vars.yml
+# HOST: astro-orbiter (10.1.71.130)
+# ROLE: Ollama inference host with AMD RX 5700 GPU passthrough
+# ------------------------------------------------------------------------------
+
+ansible_host: 10.1.71.130
+ansible_user: wed
+ansible_become: true
+
+# LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv
+
+# Ollama — all defaults apply; explicitly documented here for visibility
+ollama_rocm_version: "6.2"
+ollama_default_model: "qwen3:8b"
+ollama_hsa_override_gfx_version: "10.1.0"
+ollama_data_disk: /dev/sdb
+ollama_data_vg: ollama-vg
+ollama_data_lv: ollama-lv
+ollama_data_dir: /var/lib/ollama

ansible/host_vars/carousel-of-progress/vars.yml

@@ -0,0 +1,16 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/host_vars/astro_orbiter/vars.yml
+# HOST: astro-orbiter (10.1.71.130)
+# ROLE: Ollama inference host with AMD RX 5700 GPU passthrough
+# ------------------------------------------------------------------------------
+
+ansible_host: 10.1.71.131
+ansible_user: wed
+ansible_become: true
+
+# LVM root expansion — xlarge template uses sda3 partition, standard VG/LV names
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv

ansible/host_vars/cinderella-castle/vars

@@ -1,49 +0,0 @@
----
-# file: host_vars/vm_template/vars
-# Ansible vars template for hosts created via cloning.
-
-# Supported hypervisors:
-# - Proxmox
-
-platform: "proxmox"
-
-# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
-
-proxmox_clone_node: "fantasyland"
-
-# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
-# Current OS offerings are:
-# - Fedora (42)
-# Current VM sizes are:
-# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
-# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
-# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
-# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
-# - Xlarge Plus: 4 cores, 8GB memory, 128 GiB virtual disk
-
-vm_clone_source: "fedora-42-xlarge-plus"
-
-# Proxmox storage target.
-
-vm_storage: "general"
-
-# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
-# and backup groups. (ha_group will be factored out in the next functionality update.)
-
-ha_group: "fantasyland"
-proxmox_host_target: "fantasyland"
-
-# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
-# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
-
-ip_address: 10.1.71.21
-
-# Software
-# Future enhancement will allow specification of additional software to automatically deploy to
-# the VM after creation.
-
-#terraform_version: "1.11.3"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/guest-relations/vars

@@ -0,0 +1,12 @@
+---
+# file: host_vars/guest-relations/vars
+# guest-relations — Guest Relations
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.40
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: identity_provider
+app_name: authentik
+app_deployment: docker_compose

ansible/host_vars/int-master01/vars

@@ -1,29 +0,0 @@
----
-# file: host_vars/int-master01/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "master"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.61
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp0s31f6"
-boot_mac_address: "54:bf:64:60:52:2d"
-primary_interface: "enp1s0f0"
-install_mac_address: "98:b7:85:20:47:22"
-
-# Static Variables
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-master02/vars

@@ -1,29 +0,0 @@
----
-# file: host_vars/int-master02/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "master"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.62
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp0s31f6"
-boot_mac_address: "54:bf:64:5f:a2:80"
-primary_interface: "enp1s0f0"
-install_mac_address: "98:b7:85:20:47:3a"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-master03/vars

@@ -1,29 +0,0 @@
----
-# file: host_vars/int-master03/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "master"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.63
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp0s31f6"
-boot_mac_address: "d8:9e:f3:4c:02:a9"
-primary_interface: "enp1s0f0"
-install_mac_address: "98:b7:85:1f:89:cf"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-worker01/vars

@@ -1,29 +0,0 @@
----
-# file: host_vars/int-worker02/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "worker"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.164
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp87s0"
-boot_mac_address: "36:47:ca:76:13:49"
-primary_interface: "enp2s0f0"
-install_mac_address: "36:47:ca:76:13:47"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/int-worker02/vars

@@ -1,29 +0,0 @@
----
-# file: host_vars/int-worker02/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "worker"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.65
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp87s0"
-boot_mac_address: "58:47:ca:76:13:49"
-primary_interface: "enp2s0f0"
-install_mac_address: "58:47:ca:76:13:47"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/lightning_lane/vars

@@ -1,33 +1,12 @@
 ---
 # file: host_vars/lightning_lane/vars
-# Traefik Load Balancer Server
+# lightning-lane — Traefik Reverse Proxy / Load Balancer
+# VM provisioned by Terraform (pre-pipeline bootstrap)
 
-# Supported hypervisors:
-# - Proxmox
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.35
 
-platform: "proxmox"
-
-# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
-proxmox_clone_node: "fantasyland"
-
-# VM Configuration
-vm_os_distribution: "ubuntu"
-vm_os_version: "24.04"
-vm_size: "small"
-vm_storage: "general"
-
-# Proxmox HA Configuration
-ha_group: "pve02"
-proxmox_host_target: "pve02"
-
-# Network Configuration
-# IP address for the Traefik load balancer
-ip_address: 10.1.71.24
-#vm_mac_address: 'BC:24:11:50:00:80'
-
-# Software Configuration
-# Traefik will be installed and configured on this host
-
-# VM Template Configuration
-#vm_clone_source: "{{ vm_os_distribution }}-{{ vm_os_version }}-{{ vm_size }}"
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: reverse_proxy
+app_name: traefik
+app_deployment: docker_compose

ansible/host_vars/main-street-station/main.yml

@@ -0,0 +1,16 @@
+---
+# Host-specific vars for main-street-station (JMRI headless server)
+# LCRR - Lake Country Railroad, Milwaukee Road Oct 1956, HO scale
+
+# JMRI profile ID — find with: ls ~/.jmri/profiles/ on the old box
+# Format: <name>.<8-char-hex>  e.g. LCRR.3d3f1dfc
+# TODO: fill in after restoring config from GitHub backup
+jmri_profile_id: ""
+
+# USB serial device for NCE command station
+# Verify after install: ls -la /dev/ttyUSB* /dev/ttyACM*
+jmri_serial_device: /dev/ttyUSB0
+
+# Path to JMRI config backup for restore task (leave empty to skip)
+# Point at a local checkout of the LCRR GitHub repo
+jmri_config_src: ""

ansible/host_vars/main-street-station/vars.yml

@@ -0,0 +1,10 @@
+---
+# main-street-station — JMRI / LCRR server
+jmri_profile_id: "Lake_Country_Railroad.3e8b1d4b"
+jmri_lcrr_repo: "ssh://git@gitea.mk-labs.cloud:2221/rblundon/LCRR.git"
+jmri_lcrr_branch: "clean-profile"
+jmri_leviton_email: "{{ leviton_email }}"
+jmri_leviton_password: "{{ leviton_password }}"
+jmri_ssh_authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnSM/9fO8rz/amqkyoGUzUKNNzzmtSXPwOCr1O9zKNO ansible"
+jmri_ssh_authorized_keys_extra:
+  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6HaK4Y21UwPRbAZ986L7I9QnUdyq53114+9kO8X4bL rblundon@laptop"

ansible/host_vars/monitor/vars

@@ -1,17 +0,0 @@
----
-# file: host_vars/monitor/vars
-
-# VM Definition
-platform: "proxmox"
-proxmox_clone_node: "pve03"
-vm_clone_source: "fedora-42-large"
-vm_storage: "pve-general"
-ha_group: "pve03"
-
-# Networking
-ip_address: 10.1.71.249
-
-# Software
-#terraform_version: "1.11.3"
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}" #change variable to fqdn

ansible/host_vars/ocp-hub/vars

@@ -1,31 +0,0 @@
----
-# file: host_vars/ocp-hub/vars
-
-# file: host_vars/int-master01/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "master"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.10
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp0s31f6"
-boot_mac_address: "50:9A:4C:52:A8:5D"
-primary_interface: "enp1s0f0"
-install_mac_address: "98:b7:85:1e:c6:f1"
-
-# Static Variables
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}"

ansible/host_vars/openshift_node_template/vars

@@ -1,29 +0,0 @@
----
-# file: host_vars/openshift_node_template/vars
-# Ansible vars template for OpenShift nodes created via Ansible (configure_openshift_cluster).
-
-# Cluster deployed via Agent Installer and Matchbox (iPXE):
-
-# Role of this node in the cluster. 
-# - master
-# - worker
-
-node_role: "master"
-
-# IP address assigned to this node on the Primary Interface
-
-ip_address: 10.1.71.61
-
-# Ansible Playbook supports booting node via one interface, but installing on a 
-# different interface. (Disabling the boot interface on install)  All these fields
-# are necessary.  In the case of a single NIC node, interfaces and MAC addresses
-# should be the same.
-
-boot_interface: "enp0s31f6"
-boot_mac_address: "54:bf:64:60:52:2d"
-primary_interface: "enp1s0f0"
-install_mac_address: "98:b7:85:20:47:22"
-
-# Static Variables
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/turnstile/vars

@@ -0,0 +1,27 @@
+---
+# file: host_vars/turnstile/vars
+# turnstile — Smallstep step-ca SSH Certificate Authority
+# VM provisioned by Terraform (pre-pipeline bootstrap)
+
+# ─── Network ─────────────────────────────────────────────────────────────────
+ip_address: 10.1.71.34
+
+# ─── Application ─────────────────────────────────────────────────────────────
+app_role: ssh_certificate_authority
+app_name: step-ca
+app_deployment: docker_compose
+
+# ─── step-ca Configuration ───────────────────────────────────────────────────
+stepca_hostname: turnstile.local.mk-labs.cloud
+stepca_dns_names: "turnstile.local.mk-labs.cloud,10.1.71.34"
+stepca_ssh_enabled: true
+stepca_listen_port: 9000
+
+# ─── OIDC Provisioner (Authentik) ────────────────────────────────────────────
+# Client ID and secret stored in vault
+stepca_oidc_provisioner_name: authentik
+stepca_oidc_configuration_endpoint: "https://authentik.local.mk-labs.cloud/application/o/step-ca/.well-known/openid-configuration"
+stepca_oidc_listen_address: ":10000"
+stepca_oidc_domains:
+  - "local.mk-labs.cloud"
+  - "protonmail.com"

ansible/host_vars/turnstile/vault

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+30383930323363386234333433636465393263613336646464666365643730386430353864616334
+3865343031653162313736656437373666636136653263360a613961646133376262633164393535
+31363434633634303035663133316230633538363936303266373931313661346563333832653032
+6239376363646530620a303231363333363233623038326165316463383662656565626534396232
+62333133623530643932643430663166373930353733363866336533643233373261333130613635
+31633337376337663833613634666436383862386431636537373363343333323932363761653366
+61353166613162346436396138316561646165303566376366323462663861616364336539313138
+30386430373566353761383636626335393463376661356666303861353564313832346333396134
+30653861363866336331336164323130623230666237356165613934333239386536373664643065
+33643139346562346663313533643433353462363665323166313364373335366665373435643935
+65303863663864393238393732303065343364306264396333376233666233346664323334336532
+38373164383835663163363137643531303163396236623565666436363261393563343133333161
+36663934303633663062346161636333396135336135616136303664636562363862353764343562
+39643430396636313139336130656363306562363430346233313530663963366238326334623135
+62383632613061316262323038303333323739303137363334626637666663666263613132336433
+65346266393733633632

ansible/host_vars/unbound01/vars

@@ -1,47 +0,0 @@
----
-# file: host_vars/unbound01/vars
-
-# Supported hypervisors:
-# - Proxmox
-
-platform: "proxmox"
-
-# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
-
-proxmox_clone_node: "pve03"
-
-# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
-# Current OS offerings are:
-# - Fedora (42)
-# Current VM sizes are:
-# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
-# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
-# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
-# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
-
-vm_clone_source: "fedora-42-small"
-
-# Proxmox storage target.
-
-vm_storage: "pve-general"
-
-# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
-# and backup groups. (ha_group will be factored out in the next functionality update.)
-
-ha_group: "pve03"
-proxmox_host_target: "pve03"
-
-# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
-# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
-
-ip_address: 10.1.71.251
-
-# Software
-# Future enhancement will allow specification of additional software to automatically deploy to
-# the VM after creation.
-
-#terraform_version: "1.11.3"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/host_vars/unbound02/vars

@@ -1,47 +0,0 @@
----
-# file: host_vars/unbound02/vars
-
-# Supported hypervisors:
-# - Proxmox
-
-platform: "proxmox"
-
-# This is the Proxmox node where all the VM templates are stored. (Templates are not global.)
-
-proxmox_clone_node: "pve03"
-
-# Templates are named in the following format (all lower case): <OS Distribution>-<OS Version>-<VM Size>
-# Current OS offerings are:
-# - Fedora (42)
-# Current VM sizes are:
-# - Small: 2 cores, 2GB memory, 8 GiB virtual disk
-# - Medium: 2 cores, 4GB memory, 16 GiB virtual disk
-# - Large: 4 cores, 4GB memory, 32 GiB virtual disk
-# - Xlarge: 4 cores, 8GB memory, 64 GiB virtual disk
-
-vm_clone_source: "fedora-42-small"
-
-# Proxmox storage target.
-
-vm_storage: "pve-general"
-
-# Proxmox does not yet do dynamic load balancing, the host target sets the target for HA groups
-# and backup groups. (ha_group will be factored out in the next functionality update.)
-
-ha_group: "pve03"
-proxmox_host_target: "pve03"
-
-# Currently, only single NIC VMs using IPv4 are supported via cloning.  The IP address also 
-# sets the Proxmox VMID.  The VMID is a combination of the 3rd and 4th octet of the IPv4 address.
-
-ip_address: 10.1.71.252
-
-# Software
-# Future enhancement will allow specification of additional software to automatically deploy to
-# the VM after creation.
-
-#terraform_version: "1.11.3"
-
-# ---
-
-hostname: "{{ inventory_hostname }}.{{ base_domain }}" # Change variable to fqdn

ansible/inventory.yml

@@ -1,15 +1,12 @@
 # file: inventory.yml
 proxmox:
   hosts:
-    pve0[1:3]:
-
-ntp_servers:
-  hosts:
-    sundial:
-    
-dns_server:
-  hosts:
-    monorail:
+    main-street-usa:
+      ansible_host: 10.1.71.11
+      ansible_user: wed
+      ansible_become: true
+    tomorrowland:
+    fantasyland:
 
 magic_kingdom:
   hosts:
@@ -17,47 +14,91 @@ magic_kingdom:
     tomorrowland:
     fantasyland:
 
-prometheus_server:
+dns_server:
   hosts:
-    cinderella-castle:
+    monorail:
 
-prometheus_nodes:
+ntp_servers:
   hosts:
-    cinderella-castle:
-
+    sundial:
+    
 load_balancers:
   hosts:
     lightning-lane:
-      ansible_host: 10.1.71.24
       ansible_become: true
-# node_explorer:
-#   hosts:
-#     cinderella-castle:
 
-# alertmanager:
-#   hosts:
-#     cinderella-castle:
+step_ca_server:
+  hosts:
+    turnstile:
+      ansible_become: true
 
-# grafana:
-#   hosts:
-#     cinderella-castle:
+authentik_server:
+  hosts:
+    guest-relations:
+      ansible_become: true
+
+gitea_servers:
+  hosts:
+    mad-tea-party:
+      ansible_user: wed
+      ansible_become: true
+
+nextcloud_server:
+  hosts:
+    the-grid:
+      ansible_become: true
+
+semaphore_server:
+  hosts:
+    figment:
+      ansible_host: 10.1.71.37
+      ansible_user: wed
+      ansible_become: true
+
+n8n_server:
+  hosts:
+    tiki-room:
+
+ollama_server:
+  hosts:
+    astro-orbiter:
+      ansible_host: 10.1.71.130
+      ansible_user: wed
+      ansible_become: true
+
+hermes_server:
+  hosts:
+    carousel-of-progress:
+      ansible_host: 10.1.71.131
+      ansible_user: wed
+      ansible_become: true
+
+honcho_server:
+  hosts:
+    lincoln:
+      ansible_host: 10.1.71.132
+      ansible_user: wed
+      ansible_become: true
+
+jmri_server:
+  hosts:
+    main-street-station:
+      ansible_host: 192.168.10.40
+      ansible_user: wed
+      ansible_become: true
 
 papermc_server:
 # ansible-galaxy role install engonzal.papermc
   hosts:
     arcade:
 
-semaphore_server:
+dev_servers:
   hosts:
-    imagineering:
-
-n8n_server:
-  hosts:
-    tiki-room:
-
-traefik_server:
-  hosts:
-    lightning_lane:
+    scrim:
+    backstage:
+      ansible_host: 10.1.71.133
+      ansible_user: wed
+      ansible_become: true
 
 # dhcp_server:
 #   hosts:
@@ -67,13 +108,13 @@ backup_servers:
   hosts:
     timekeeper:
 
-# freeipa:
-#   hosts:
-#     infra01:
-
-# ipaserver:
-#   hosts:
-#     infra01.int.mk-labs.cloud:
+talos_control:
+  hosts:
+    city-hall:
+      ansible_become: true
+  vars:
+    talosctl_version: "v1.12.4"
+    talos_cluster_name: "fastpass"
 
 # matchbox_server:
 #   hosts:
@@ -82,51 +123,3 @@ backup_servers:
 terraform_server:
   hosts:
     infra01:
-
-# hub_cluster:
-#   hosts:
-#     ocp-hub:
-
-# internal_cluster:
-#   hosts:
-#     int-master01:
-#     int-master02:
-#     int-master03:
-# #    int-worker01:
-#     int-worker02:
-
-# talos_cluster:
-#   hosts:
-#     splash:
-
-# fastpass_control_plane:
-#   hosts:
-#     space-mountain:
-#     big-thunder-mountain:
-#     splash-mountain:
-
-# fastpass_workers:
-#   hosts:
-#     haunted-mansion: # backstage
-#     peter-pans-flight: # backstage
-
-# fastpass:
-#   children:
-#     fastpass_control_plane:
-#     fastpass_workers:
-
-# sql_servers:
-#   hosts:
-#     sql01:
-
-# docker_servers:
-#   hosts:
-#     docker01:
-
-# observer:
-#   hosts:
-#     prometheus:
-
-# target:
-#   hosts:
-#     prometheus:

ansible/playbooks/add_service_route.yml

@@ -0,0 +1,95 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/add_service_route.yml
+# DESCRIPTION: Ensures all services in the Traefik dynamic config directory
+#              are routed and have DNS CNAME records on monorail.
+#
+#              1. Syncs boilerplates/traefik/dynamic/ to lightning-lane
+#              2. Scans the directory for service configs
+#              3. Extracts all hostnames from Host() rules (supports multi-host)
+#              4. Creates CNAME records for each hostname -> lightning-lane
+#
+# PREREQUISITES:
+#   - Service dynamic config YAML committed to boilerplates/traefik/dynamic/
+#   - vault_technitium_api_key defined in group_vars/all/vault
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/add_service_route.yml
+# ------------------------------------------------------------------------------
+
+- name: Sync Traefik routes and ensure DNS records
+  hosts: localhost
+  connection: local
+  gather_facts: false
+
+  vars:
+    base_domain: "local.mk-labs.cloud"
+    dns_server: "monorail"
+    traefik_host: "lightning-lane.local.mk-labs.cloud"
+    traefik_user: "wed"
+    traefik_dynamic_path: "/opt/docker/traefik/dynamic/"
+    dynamic_config_dir: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic"
+
+    # Files in the dynamic directory that are NOT service routes
+    exclude_configs:
+      - default.yml
+
+  tasks:
+    # ── Step 1: Sync dynamic config to lightning-lane ──
+    - name: Sync Traefik dynamic configuration to lightning-lane
+      ansible.builtin.shell: >
+        rsync -av --delete
+        {{ dynamic_config_dir }}/
+        {{ traefik_user }}@{{ traefik_host }}:{{ traefik_dynamic_path }}
+      register: sync_result
+      changed_when: "'sending incremental file list' in sync_result.stdout"
+
+    # ── Step 2: Discover hostnames from Traefik router rules ──
+    - name: Find all dynamic config files
+      ansible.builtin.find:
+        paths: "{{ dynamic_config_dir }}"
+        patterns: "*.yml"
+      register: config_files
+
+    - name: Read config files
+      ansible.builtin.slurp:
+        src: "{{ item.path }}"
+      register: slurped_configs
+      loop: "{{ config_files.files }}"
+      when: item.path | basename not in exclude_configs
+
+    - name: Extract all hostnames from Host() rules
+      ansible.builtin.set_fact:
+        hostnames: >-
+          {% set hosts = [] -%}
+          {% for result in slurped_configs.results if result.content is defined -%}
+            {% set content = result.content | b64decode -%}
+            {% for match in content | regex_findall('Host\(`([^`]+)`\)') -%}
+              {% for h in match.split(' || ') -%}
+                {% set h = h | regex_replace('`', '') | trim -%}
+                {% if h.endswith('.local.mk-labs.cloud') and h not in hosts -%}
+                  {% set _ = hosts.append(h) -%}
+                {% endif -%}
+              {% endfor -%}
+            {% endfor -%}
+          {% endfor -%}
+          {{ hosts | unique | list }}
+
+    - name: Display hostnames to create
+      ansible.builtin.debug:
+        msg: "Hostnames found: {{ hostnames }}"
+
+    # ── Step 3: Create DNS CNAME records ──
+    - name: Create DNS CNAME record for each hostname
+      effectivelywild.technitium_dns.technitium_dns_add_record:
+        api_url: "http://{{ dns_server }}.{{ base_domain }}"
+        api_token: "{{ vault_technitium_api_key }}"
+        zone: "{{ base_domain }}"
+        name: "{{ item }}"
+        type: "CNAME"
+        cname: "lightning-lane.{{ base_domain }}"
+        ttl: 360
+        validate_certs: false
+      loop: "{{ hostnames }}"
+      loop_control:
+        label: "{{ item }}"

ansible/playbooks/configure_openshift_cluster.yml

@@ -1,218 +0,0 @@
----
-- name: Configure DNS entries for cluster nodes
-  hosts: internal_cluster
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Create DNS entry for each cluster node
-      ansible.builtin.include_tasks: tasks/create_dns_record.yml
-      vars:
-        host_ip_address: "{{ ip_address }}"
-
-- name: Configure DNS entries for OpenShift cluster services
-  hosts: internal_cluster[0]
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Create DNS entries for OpenShift cluster services
-      ansible.builtin.include_tasks: tasks/create_dns_record.yml
-      vars:
-        dns_name: "{{ item.name }}"
-        dns_address: "{{ item.address }}"
-      loop:
-        - name: "api.{{ cluster_name }}"
-          address: "{{ api_address }}"
-        - name: "api-int.{{ cluster_name }}"
-          address: "{{ api_address }}"
-        - name: "*.apps.{{ cluster_name }}"
-          address: "{{ app_address }}"
-      loop_control:
-        label: "{{ item.name }}"
-
-- name: Configure DHCP entries for cluster nodes
-  hosts: internal_cluster
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Configure DHCP entry for node
-      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
-      vars:
-        host_mac_address: "{{ install_mac_address }}"
-        host_ip_address: "{{ ip_address }}"
-
-  handlers:
-    - name: Restart dnsmasq
-      delegate_to: "{{ dhcp_server }}"
-      become: true
-      ansible.builtin.service:
-        name: dnsmasq
-        state: restarted
-
-- name: Create OpenShift installer files
-  hosts: matchbox
-  gather_facts: true
-
-  vars:
-    cluster_group: "internal_cluster"
-    download_dir: "/var/cache/openshift-install"
-
-  tasks:
-    - name: Remove previous directory
-      ansible.builtin.file:
-        path: ~/homelab/terraform/{{ cluster_group }}
-        state: absent
-
-    - name: Create directory
-      ansible.builtin.file:
-        path: ~/homelab/terraform/{{ cluster_group }}
-        state: directory
-        mode: '0755'
-
-    - name: OpenShift Installer install-config.yaml
-      ansible.builtin.template:
-        src: templates/install-config.yaml.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
-        mode: '0644'
-
-    - name: OpenShift Installer agent-config.yaml
-      ansible.builtin.template:
-        src: templates/agent-config.yaml.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
-        mode: '0644'
-
-    - name: Create directory for OpenShift Installer files
-      become: true
-      ansible.builtin.file:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
-        state: directory
-        mode: '0755'
-        owner: root
-        group: root
-
-    - name: Check if OpenShift installer file exists
-      ansible.builtin.stat:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
-      register: openshift_installer_file
-
-    - name: Download and install OpenShift installer package
-      when: not openshift_installer_file.stat.exists
-      block:
-        - name: Download OpenShift Installer file
-          become: true
-          ansible.builtin.get_url:
-            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            mode: '0644'
-
-        - name: Unarchive installer file
-          become: true
-          ansible.builtin.unarchive:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            remote_src: true
-
-        - name: Copy install binary
-          become: true
-          ansible.builtin.copy:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
-            dest: /usr/local/bin
-            remote_src: true
-            owner: wed
-            group: wed
-            mode: '0755'
-
-    - name: Check if OpenShift client file exists
-      ansible.builtin.stat:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
-      register: openshift_client_file
-
-    - name: Download and install OpenShift client package
-      when: not openshift_client_file.stat.exists
-      block:
-        - name: Download OpenShift Client file
-          become: true
-          ansible.builtin.get_url:
-            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            mode: '0644'
-
-        - name: Unarchive client file
-          become: true
-          ansible.builtin.unarchive:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            remote_src: true
-
-        - name: Copy client binary
-          become: true
-          ansible.builtin.copy:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
-            dest: /usr/local/bin
-            remote_src: true
-            owner: wed
-            group: wed
-            mode: '0755'
-
-    - name: Check if OpenShift image exists
-      ansible.builtin.stat:
-        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
-      register: openshift_image_exists
-
-    - name: OpenShift image creation
-      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
-      args:
-        chdir: ~/homelab/terraform/{{ cluster_group }}
-      when: not openshift_image_exists.stat.exists
-      changed_when: true
-
-    - name: Create a directory if it does not exist
-      become: true
-      ansible.builtin.file:
-        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
-        state: directory
-        owner: matchbox
-        group: matchbox
-        mode: '0755'
-
-    - name: Copy file with owner and permissions
-      become: true
-      ansible.builtin.copy:
-        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
-        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
-        remote_src: true
-        owner: matchbox
-        group: matchbox
-        mode: '0644'
-
-    - name: Verify directory permissions
-      become: true
-      ansible.builtin.file:
-        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
-        state: directory
-        owner: matchbox
-        group: matchbox
-        mode: '0755'
-
-    - name: Create Terraform matchbox groups file from template
-      ansible.builtin.template:
-        src: templates/groups.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
-        mode: '0644'
-
-    - name: Create Terraform matchbox profiles file from template
-      ansible.builtin.template:
-        src: templates/profiles.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
-        mode: '0644'
-
-    - name: Create Terraform matchbox provider file from template
-      ansible.builtin.template:
-        src: templates/provider.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
-        mode: '0644'
-
-    - name: Configure Matchbox via Terraform
-      community.general.terraform:
-        project_path: ~/homelab/terraform/{{ cluster_group }}
-        state: present
-        force_init: true

ansible/playbooks/configure_openshift_hub.yml

@@ -1,221 +0,0 @@
----
-- name: Configure DNS entries for cluster nodes
-  hosts: hub_cluster
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Create DNS entry for each cluster node
-      ansible.builtin.include_tasks: tasks/create_dns_record.yml
-      vars:
-        host_ip_address: "{{ ip_address }}"
-
-- name: Configure DNS entries for OpenShift cluster services
-  hosts: hub_cluster[0]
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Create DNS entries for OpenShift cluster services
-      ansible.builtin.include_tasks: tasks/create_dns_record.yml
-      vars:
-        dns_name: "{{ item.name }}"
-        dns_address: "{{ item.address }}"
-      loop:
-        - name: "api.{{ cluster_name }}"
-          address: "{{ api_address }}"
-        - name: "api-int.{{ cluster_name }}"
-          address: "{{ api_address }}"
-        - name: "*.apps.{{ cluster_name }}"
-          address: "{{ app_address }}"
-      loop_control:
-        label: "{{ item.name }}"
-
-- name: Configure DHCP entries for cluster nodes
-  hosts: hub_cluster
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Configure DHCP entry for node
-      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
-      vars:
-        host_mac_address: "{{ install_mac_address }}"
-        host_ip_address: "{{ ip_address }}"
-
-  handlers:
-    - name: Restart dnsmasq
-      delegate_to: "{{ dhcp_server }}"
-      become: true
-      ansible.builtin.service:
-        name: dnsmasq
-        state: restarted
-
-- name: Create OpenShift installer files
-  hosts: matchbox
-  gather_facts: true
-
-  vars:
-    cluster_group: "hub_cluster"
-    download_dir: "/var/cache/openshift-install"
-
-  tasks:
-    - name: Remove previous directory
-      ansible.builtin.file:
-        path: ~/homelab/terraform/{{ cluster_group }}
-        state: absent
-
-    - name: Create directory
-      ansible.builtin.file:
-        path: ~/homelab/terraform/{{ cluster_group }}
-        state: directory
-        mode: '0755'
-
-    - name: OpenShift Installer install-config.yaml
-      ansible.builtin.template:
-        src: templates/install-config.yaml.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
-        mode: '0644'
-
-    - name: OpenShift Installer agent-config.yaml
-      ansible.builtin.template:
-        src: templates/agent-config.yaml.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
-        mode: '0644'
-
-    # - name: Quit
-    #   ansible.builtin.meta: end_play
-
-    - name: Create directory for OpenShift Installer files
-      become: true
-      ansible.builtin.file:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
-        state: directory
-        mode: '0755'
-        owner: root
-        group: root
-
-    - name: Check if OpenShift installer file exists
-      ansible.builtin.stat:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
-      register: openshift_installer_file
-
-    - name: Download and install OpenShift installer package
-      when: not openshift_installer_file.stat.exists
-      block:
-        - name: Download OpenShift Installer file
-          become: true
-          ansible.builtin.get_url:
-            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            mode: '0644'
-
-        - name: Unarchive installer file
-          become: true
-          ansible.builtin.unarchive:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            remote_src: true
-
-        - name: Copy install binary
-          become: true
-          ansible.builtin.copy:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
-            dest: /usr/local/bin
-            remote_src: true
-            owner: wed
-            group: wed
-            mode: '0755'
-
-    - name: Check if OpenShift client file exists
-      ansible.builtin.stat:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
-      register: openshift_client_file
-
-    - name: Download and install OpenShift client package
-      when: not openshift_client_file.stat.exists
-      block:
-        - name: Download OpenShift Client file
-          become: true
-          ansible.builtin.get_url:
-            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            mode: '0644'
-
-        - name: Unarchive client file
-          become: true
-          ansible.builtin.unarchive:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            remote_src: true
-
-        - name: Copy client binary
-          become: true
-          ansible.builtin.copy:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
-            dest: /usr/local/bin
-            remote_src: true
-            owner: wed
-            group: wed
-            mode: '0755'
-
-    - name: Check if OpenShift image exists
-      ansible.builtin.stat:
-        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
-      register: openshift_image_exists
-
-    - name: OpenShift image creation
-      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
-      args:
-        chdir: ~/homelab/terraform/{{ cluster_group }}
-      when: not openshift_image_exists.stat.exists
-      changed_when: true
-
-    - name: Create a directory if it does not exist
-      become: true
-      ansible.builtin.file:
-        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
-        state: directory
-        owner: matchbox
-        group: matchbox
-        mode: '0755'
-
-    - name: Copy file with owner and permissions
-      become: true
-      ansible.builtin.copy:
-        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
-        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
-        remote_src: true
-        owner: matchbox
-        group: matchbox
-        mode: '0644'
-
-    - name: Verify directory permissions
-      become: true
-      ansible.builtin.file:
-        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
-        state: directory
-        owner: matchbox
-        group: matchbox
-        mode: '0755'
-
-    - name: Create Terraform matchbox groups file from template
-      ansible.builtin.template:
-        src: templates/groups.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
-        mode: '0644'
-
-    - name: Create Terraform matchbox profiles file from template
-      ansible.builtin.template:
-        src: templates/profiles.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
-        mode: '0644'
-
-    - name: Create Terraform matchbox provider file from template
-      ansible.builtin.template:
-        src: templates/provider.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
-        mode: '0644'
-
-    - name: Configure Matchbox via Terraform
-      community.general.terraform:
-        project_path: ~/homelab/terraform/{{ cluster_group }}
-        state: present
-        force_init: true

ansible/playbooks/configure_openshift_internal.yml

@@ -1,218 +0,0 @@
----
-- name: Configure DNS entries for cluster nodes
-  hosts: internal_cluster
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Create DNS entry for each cluster node
-      ansible.builtin.include_tasks: tasks/create_dns_record.yml
-      vars:
-        host_ip_address: "{{ ip_address }}"
-
-- name: Configure DNS entries for OpenShift cluster services
-  hosts: internal_cluster[0]
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Create DNS entries for OpenShift cluster services
-      ansible.builtin.include_tasks: tasks/create_dns_record.yml
-      vars:
-        dns_name: "{{ item.name }}"
-        dns_address: "{{ item.address }}"
-      loop:
-        - name: "api.{{ cluster_name }}"
-          address: "{{ api_address }}"
-        - name: "api-int.{{ cluster_name }}"
-          address: "{{ api_address }}"
-        - name: "*.apps.{{ cluster_name }}"
-          address: "{{ app_address }}"
-      loop_control:
-        label: "{{ item.name }}"
-
-- name: Configure DHCP entries for cluster nodes
-  hosts: internal_cluster
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Configure DHCP entry for node
-      ansible.builtin.include_tasks: tasks/configure_dhcp_entry.yml
-      vars:
-        host_mac_address: "{{ install_mac_address }}"
-        host_ip_address: "{{ ip_address }}"
-
-  handlers:
-    - name: Restart dnsmasq
-      delegate_to: "{{ dhcp_server }}"
-      become: true
-      ansible.builtin.service:
-        name: dnsmasq
-        state: restarted
-
-- name: Create OpenShift installer files
-  hosts: matchbox
-  gather_facts: true
-
-  vars:
-    cluster_group: "internal_cluster"
-    download_dir: "/var/cache/openshift-install"
-
-  tasks:
-    - name: Remove previous directory
-      ansible.builtin.file:
-        path: ~/homelab/terraform/{{ cluster_group }}
-        state: absent
-
-    - name: Create directory
-      ansible.builtin.file:
-        path: ~/homelab/terraform/{{ cluster_group }}
-        state: directory
-        mode: '0755'
-
-    - name: OpenShift Installer install-config.yaml
-      ansible.builtin.template:
-        src: templates/install-config.yaml.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/install-config.yaml
-        mode: '0644'
-
-    - name: OpenShift Installer agent-config.yaml
-      ansible.builtin.template:
-        src: templates/agent-config.yaml.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/agent-config.yaml
-        mode: '0644'
-
-    - name: Create directory for OpenShift Installer files
-      become: true
-      ansible.builtin.file:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}"
-        state: directory
-        mode: '0755'
-        owner: root
-        group: root
-
-    - name: Check if OpenShift installer file exists
-      ansible.builtin.stat:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_installer_file }}"
-      register: openshift_installer_file
-
-    - name: Download and install OpenShift installer package
-      when: not openshift_installer_file.stat.exists
-      block:
-        - name: Download OpenShift Installer file
-          become: true
-          ansible.builtin.get_url:
-            url: "{{ hostvars[groups[cluster_group][0]].openshift_installer_download_url }}"
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            mode: '0644'
-
-        - name: Unarchive installer file
-          become: true
-          ansible.builtin.unarchive:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install-linux.tar.gz
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            remote_src: true
-
-        - name: Copy install binary
-          become: true
-          ansible.builtin.copy:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-install
-            dest: /usr/local/bin
-            remote_src: true
-            owner: wed
-            group: wed
-            mode: '0755'
-
-    - name: Check if OpenShift client file exists
-      ansible.builtin.stat:
-        path: "{{ download_dir }}/{{ hostvars[groups[cluster_group][0]].cluster_version }}/{{ hostvars[groups[cluster_group][0]].openshift_client_file }}"
-      register: openshift_client_file
-
-    - name: Download and install OpenShift client package
-      when: not openshift_client_file.stat.exists
-      block:
-        - name: Download OpenShift Client file
-          become: true
-          ansible.builtin.get_url:
-            url: "{{ hostvars[groups[cluster_group][0]].openshift_client_download_url }}"
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            mode: '0644'
-
-        - name: Unarchive client file
-          become: true
-          ansible.builtin.unarchive:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/openshift-client-linux.tar.gz
-            dest: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}
-            remote_src: true
-
-        - name: Copy client binary
-          become: true
-          ansible.builtin.copy:
-            src: /var/cache/openshift-install/{{ hostvars[groups[cluster_group][0]].cluster_version }}/oc
-            dest: /usr/local/bin
-            remote_src: true
-            owner: wed
-            group: wed
-            mode: '0755'
-
-    - name: Check if OpenShift image exists
-      ansible.builtin.stat:
-        path: ~/homelab/terraform/{{ cluster_group }}/boot-artifacts/agent.x86_64-initrd.img
-      register: openshift_image_exists
-
-    - name: OpenShift image creation
-      ansible.builtin.command: /usr/local/bin/openshift-install agent create pxe-files
-      args:
-        chdir: ~/homelab/terraform/{{ cluster_group }}
-      when: not openshift_image_exists.stat.exists
-      changed_when: true
-
-    - name: Create a directory if it does not exist
-      become: true
-      ansible.builtin.file:
-        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
-        state: directory
-        owner: matchbox
-        group: matchbox
-        mode: '0755'
-
-    - name: Copy file with owner and permissions
-      become: true
-      ansible.builtin.copy:
-        src: "{{ ansible_env['HOME'] }}/homelab/terraform/{{ cluster_group }}/boot-artifacts/"
-        dest: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}/"
-        remote_src: true
-        owner: matchbox
-        group: matchbox
-        mode: '0644'
-
-    - name: Verify directory permissions
-      become: true
-      ansible.builtin.file:
-        path: "{{ hostvars[groups['matchbox_server'][0]].assets }}/{{ hostvars[groups[cluster_group][0]].cluster_name }}"
-        state: directory
-        owner: matchbox
-        group: matchbox
-        mode: '0755'
-
-    - name: Create Terraform matchbox groups file from template
-      ansible.builtin.template:
-        src: templates/groups.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/groups.tf
-        mode: '0644'
-
-    - name: Create Terraform matchbox profiles file from template
-      ansible.builtin.template:
-        src: templates/profiles.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/profiles.tf
-        mode: '0644'
-
-    - name: Create Terraform matchbox provider file from template
-      ansible.builtin.template:
-        src: templates/provider.tf.j2
-        dest: ~/homelab/terraform/{{ cluster_group }}/provider.tf
-        mode: '0644'
-
-    - name: Configure Matchbox via Terraform
-      community.general.terraform:
-        project_path: ~/homelab/terraform/{{ cluster_group }}
-        state: present
-        force_init: true

ansible/playbooks/configure_proxmox_oidc.yml

@@ -0,0 +1,20 @@
+---
+# ansible/playbooks/configure_proxmox_oidc.yml
+#
+# Configures Proxmox OIDC authentication with Authentik.
+# Only targets one node since realm config is cluster-wide.
+#
+# Usage:
+#   cd ansible
+#   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml
+#
+# To also set up ACL entries for your user:
+#   ansible-playbook -i inventory.yml playbooks/configure_proxmox_oidc.yml \
+#     -e '{"proxmox_oidc_acl_entries": [{"path": "/", "user": "rblundon@authentik", "role": "Administrator"}]}'
+
+- name: Configure Proxmox Authentik OIDC
+  hosts: main-street-usa
+  become: true
+  roles:
+    - role: proxmox
+      tags: [proxmox-oidc]

ansible/playbooks/day0_baseline.yml

@@ -0,0 +1,6 @@
+---
+- name: Apply day0 baseline
+  hosts: "{{ target | default('all') }}"
+  become: true
+  roles:
+    - day0-baseline

ansible/playbooks/day0_expand_root_lv.yml

@@ -0,0 +1,32 @@
+---
+# ============================================================================
+# day0_expand_root_lv.yml
+# ----------------------------------------------------------------------------
+# Reclaims unallocated PE on the root volume group, extending the root LV
+# to fill the VG and resizing the underlying filesystem (ext4 or xfs).
+#
+# Belongs to the day0 host-provisioning lifecycle. The Ubuntu Server
+# autoinstall template ships with the root LV at ~half the disk size by
+# default; this playbook is the canonical one-shot fix-up for that.
+#
+# Idempotent and safe to re-run. Hosts without LVM are no-op'd cleanly.
+#
+# Opt-out: set `expand_root_lv_skip: true` in host_vars/<host>.yml for
+# hosts where free PE should NOT be claimed by root (e.g. hosts with a
+# planned second LV in the same VG for application data).
+#
+# Usage:
+#   ansible-playbook playbooks/day0_expand_root_lv.yml
+#   ansible-playbook playbooks/day0_expand_root_lv.yml -e target=lincoln
+#   ansible-playbook playbooks/day0_expand_root_lv.yml -e target=honcho_server
+# ============================================================================
+
+- name: Expand root logical volume to fill VG
+  hosts: "{{ target | default('all') }}"
+  become: true
+  gather_facts: true
+  tasks:
+    - name: Apply expand_root_lv role unless host opts out
+      ansible.builtin.include_role:
+        name: expand_root_lv
+      when: not (expand_root_lv_skip | default(false) | bool)

ansible/playbooks/day0_linux_baseline.yml

@@ -0,0 +1,23 @@
+---
+# ============================================================================
+# day0_linux_baseline.yml
+# ----------------------------------------------------------------------------
+# Applies the mk-labs Linux baseline (linux-baseline role) to one or more
+# hosts. Idempotent and safe to re-run.
+#
+# Usage:
+#   ansible-playbook playbooks/day0_linux_baseline.yml
+#   ansible-playbook playbooks/day0_linux_baseline.yml -e target=figment
+#   ansible-playbook playbooks/day0_linux_baseline.yml -e target=semaphore_server
+#
+# To trigger an opt-in full system upgrade:
+#   ansible-playbook playbooks/day0_linux_baseline.yml \
+#     -e target=figment -e 'baseline_features={"full_upgrade": true}'
+# ============================================================================
+
+- name: Apply mk-labs Linux baseline
+  hosts: "{{ target | default('all') }}"
+  become: true
+  gather_facts: true
+  roles:
+    - linux-baseline

ansible/playbooks/day0_provision.yml

@@ -0,0 +1,30 @@
+---
+# ============================================================================
+# day0_provision.yml
+# ----------------------------------------------------------------------------
+# Umbrella day0 playbook. Runs the full host-provisioning lifecycle in
+# the correct order against newly-built VMs, so the operator runs ONE
+# command per new host rather than chaining day0 steps manually.
+#
+# Order matters:
+#   1. linux-baseline      — timezone, NTP, packages, SSH hardening, jarvis user
+#   2. expand_root_lv      — reclaim PE left unallocated by the Ubuntu
+#                            autoinstall template default
+#
+# Idempotent: every step is safe to re-run. Suitable to apply periodically
+# from Semaphore as a baseline-drift check.
+#
+# Usage:
+#   ansible-playbook playbooks/day0_provision.yml -e target=lincoln
+#   ansible-playbook playbooks/day0_provision.yml -e target=honcho_server
+#
+# For finer control over a single phase, the constituent playbooks are:
+#   playbooks/day0_linux_baseline.yml
+#   playbooks/day0_expand_root_lv.yml
+# ============================================================================
+
+- name: Import day0 linux baseline
+  ansible.builtin.import_playbook: day0_linux_baseline.yml
+
+- name: Import day0 expand root LV
+  ansible.builtin.import_playbook: day0_expand_root_lv.yml

ansible/playbooks/day1_configure_netbox_catalog.yml

@@ -0,0 +1,400 @@
+---
+# ansible/playbooks/day1_configure_netbox_catalog.yml
+#
+# Creates the tag taxonomy and custom fields in NetBox for service catalog
+# documentation. Run once (idempotent — uses name-based checks).
+#
+# Usage (from ansible/ directory):
+#   ansible-playbook playbooks/day1_configure_netbox_catalog.yml
+#
+# Requires:
+#   - vault_netbox_token in Ansible Vault
+#   - netbox reachable at http://fire-station.local.mk-labs.cloud
+
+- name: Configure NetBox service catalog taxonomy
+  hosts: localhost
+  gather_facts: false
+
+  vars_files:
+    - "{{ playbook_dir }}/../group_vars/all/vault"
+
+  vars:
+    netbox_url: "http://fire-station.local.mk-labs.cloud"
+    netbox_token: "{{ vault_netbox_token }}"
+    netbox_api: "{{ netbox_url }}/api"
+    headers:
+      Authorization: "Token {{ netbox_token }}"
+      Content-Type: "application/json"
+      Accept: "application/json"
+
+    # ── Tag definitions ───────────────────────────────────────────────────
+    tags:
+      # Infrastructure type
+      - name: k8s
+        slug: k8s
+        color: "2196f3"   # blue
+        description: "Workload running in the fastpass Kubernetes cluster"
+      - name: vm
+        slug: vm
+        color: "4caf50"   # green
+        description: "Traditional VM or LXC on Proxmox"
+      # Service tier
+      - name: platform
+        slug: platform
+        color: "9c27b0"   # purple
+        description: "Platform/infrastructure service (not user-facing)"
+      - name: application
+        slug: application
+        color: "ff9800"   # orange
+        description: "User-facing application workload"
+      # Service categories
+      - name: monitoring
+        slug: monitoring
+        color: "607d8b"   # grey
+        description: "Metrics, logging, alerting"
+      - name: auth
+        slug: auth
+        color: "607d8b"
+        description: "Authentication and SSO"
+      - name: gitops
+        slug: gitops
+        color: "607d8b"
+        description: "GitOps and CI/CD"
+      - name: dashboard
+        slug: dashboard
+        color: "607d8b"
+        description: "Dashboard and portal services"
+      - name: storage
+        slug: storage
+        color: "607d8b"
+        description: "Storage and file services"
+      - name: dns
+        slug: dns
+        color: "607d8b"
+        description: "DNS and name resolution"
+      - name: automation
+        slug: automation
+        color: "607d8b"
+        description: "Automation and orchestration"
+      - name: networking
+        slug: networking
+        color: "607d8b"
+        description: "Network infrastructure services"
+      - name: inference
+        slug: inference
+        color: "607d8b"
+        description: "AI/ML inference workloads"
+
+    # ── Custom field definitions ──────────────────────────────────────────
+    # object_types use app_label.model format
+    custom_fields:
+      - name: hostnames
+        label: Hostnames
+        type: longtext
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "All DNS names that resolve to this service (comma-separated)"
+        ui_visible: always
+        ui_editable: yes
+
+      - name: namespace
+        label: Namespace
+        type: text
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "Kubernetes namespace (blank for VM-based services)"
+        ui_visible: always
+        ui_editable: yes
+
+      - name: managed_by
+        label: Managed By
+        type: select
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "How this service is managed"
+        choices:
+          - ArgoCD
+          - Ansible
+          - Manual
+        ui_visible: always
+        ui_editable: yes
+
+      - name: thematic_name
+        label: Thematic Name
+        type: text
+        object_types:
+          - ipam.ipaddress
+          - virtualization.virtualmachine
+        description: "Disney/Magic Kingdom thematic hostname for this service"
+        ui_visible: always
+        ui_editable: yes
+
+  tasks:
+
+    # ── Tags ─────────────────────────────────────────────────────────────
+
+    - name: Fetch existing tags
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/tags/?limit=200"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: existing_tags_response
+
+    - name: Set existing tag slugs fact
+      ansible.builtin.set_fact:
+        existing_tag_slugs: "{{ existing_tags_response.json.results | map(attribute='slug') | list }}"
+
+    - name: Create tags
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/tags/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: "{{ item.name }}"
+          slug: "{{ item.slug }}"
+          color: "{{ item.color }}"
+          description: "{{ item.description }}"
+        status_code: 201
+      loop: "{{ tags }}"
+      when: item.slug not in existing_tag_slugs
+      register: tag_creation
+      changed_when: tag_creation.status == 201
+
+    # ── Custom Fields ─────────────────────────────────────────────────────
+
+    - name: Fetch existing custom fields
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/?limit=200"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: existing_cf_response
+
+    - name: Set existing custom field names fact
+      ansible.builtin.set_fact:
+        existing_cf_names: "{{ existing_cf_response.json.results | map(attribute='name') | list }}"
+
+    - name: Create custom field — hostnames
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: hostnames
+          label: Hostnames
+          type: longtext
+          object_types: "{{ custom_fields[0].object_types }}"
+          description: "{{ custom_fields[0].description }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'hostnames' not in existing_cf_names"
+      register: cf_hostnames
+      changed_when: cf_hostnames.status == 201
+
+    - name: Create custom field — namespace
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: namespace
+          label: Namespace
+          type: text
+          object_types: "{{ custom_fields[1].object_types }}"
+          description: "{{ custom_fields[1].description }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'namespace' not in existing_cf_names"
+      register: cf_namespace
+      changed_when: cf_namespace.status == 201
+
+    - name: Create choice set for managed_by field
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: managed-by-choices
+          extra_choices:
+            - - ArgoCD
+              - ArgoCD
+            - - Ansible
+              - Ansible
+            - - Manual
+              - Manual
+        status_code: [201, 400]
+      register: choice_set
+      changed_when: choice_set.status == 201
+
+    - name: Fetch choice set ID
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=managed-by-choices"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: choice_set_response
+
+    - name: Create custom field — managed_by
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: managed_by
+          label: Managed By
+          type: select
+          object_types: "{{ custom_fields[2].object_types }}"
+          description: "{{ custom_fields[2].description }}"
+          choice_set: "{{ choice_set_response.json.results[0].id }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'managed_by' not in existing_cf_names"
+      register: cf_managed_by
+      changed_when: cf_managed_by.status == 201
+
+    - name: Create custom field — thematic_name
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: thematic_name
+          label: Thematic Name
+          type: text
+          object_types: "{{ custom_fields[3].object_types }}"
+          description: "{{ custom_fields[3].description }}"
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'thematic_name' not in existing_cf_names"
+      register: cf_thematic_name
+      changed_when: cf_thematic_name.status == 201
+
+    # ── Provisioning Pipeline Fields ──────────────────────────────────────
+    # These fields drive the NetBox → n8n → Terraform pipeline.
+    # proxmox_datastore already exists — PATCH it to add utilidor choice.
+    # data_disk_enabled and data_disk_size_gb are new POSTs.
+
+    - name: Fetch proxmox_datastore field ID
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/?name=proxmox_datastore"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: proxmox_datastore_cf_response
+
+    - name: Fetch proxmox-datastore-choices choice set ID
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=proxmox-datastore-choices"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: datastore_choice_set_response
+
+    - name: Create proxmox-datastore-choices choice set if missing
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: proxmox-datastore-choices
+          extra_choices:
+            - - liberty-tree
+              - liberty-tree
+            - - utilidor
+              - utilidor
+        status_code: [201, 400]
+      register: datastore_choice_set_create
+      changed_when: datastore_choice_set_create.status == 201
+      when: datastore_choice_set_response.json.count == 0
+
+    - name: Re-fetch proxmox-datastore-choices choice set ID after possible creation
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-field-choice-sets/?name=proxmox-datastore-choices"
+        method: GET
+        headers: "{{ headers }}"
+        return_content: true
+        status_code: 200
+      register: datastore_choice_set_response
+
+    - name: Patch proxmox_datastore field to use choice set with utilidor
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/{{ proxmox_datastore_cf_response.json.results[0].id }}/"
+        method: PATCH
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          choice_set: "{{ datastore_choice_set_response.json.results[0].id }}"
+        status_code: 200
+      when: proxmox_datastore_cf_response.json.count > 0
+      register: cf_datastore_patch
+      changed_when: cf_datastore_patch.status == 200
+
+    - name: Create custom field — data_disk_enabled
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: data_disk_enabled
+          label: Data Disk Enabled
+          type: boolean
+          object_types:
+            - virtualization.virtualmachine
+          description: "When true, Terraform provisions a second disk for application data storage."
+          default: false
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'data_disk_enabled' not in existing_cf_names"
+      register: cf_data_disk_enabled
+      changed_when: cf_data_disk_enabled.status == 201
+
+    - name: Create custom field — data_disk_size_gb
+      ansible.builtin.uri:
+        url: "{{ netbox_api }}/extras/custom-fields/"
+        method: POST
+        headers: "{{ headers }}"
+        body_format: json
+        body:
+          name: data_disk_size_gb
+          label: Data Disk Size (GB)
+          type: integer
+          object_types:
+            - virtualization.virtualmachine
+          description: "Size in GB for the optional second data disk. Only used when data_disk_enabled is true."
+          ui_visible: always
+          ui_editable: yes
+        status_code: 201
+      when: "'data_disk_size_gb' not in existing_cf_names"
+      register: cf_data_disk_size
+      changed_when: cf_data_disk_size.status == 201
+
+    # ── Summary ───────────────────────────────────────────────────────────
+
+    - name: Summary
+      ansible.builtin.debug:
+        msg:
+          - "Tags created: {{ tag_creation.results | selectattr('status', 'equalto', 201) | list | length }}"
+          - "Tags skipped (already exist): {{ tag_creation.results | selectattr('skipped', 'defined') | list | length }}"
+          - "Custom fields configured: hostnames, namespace, managed_by, thematic_name, proxmox_datastore (patched), data_disk_enabled, data_disk_size_gb"

ansible/playbooks/day1_deploy_authentik.yml

@@ -0,0 +1,18 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_authentik.yml
+# DESCRIPTION: Deploys Authentik identity provider on guest-relations.
+#              Installs Docker and configures Authentik with PostgreSQL and Redis.
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_authentik.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Authentik identity provider
+  hosts: authentik_server
+  become: true
+
+  roles:
+    - common
+    - docker-host
+    - authentik

ansible/playbooks/day1_deploy_gitea.yml

@@ -0,0 +1,23 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day1_deploy_gitea.yml
+# DESCRIPTION: Deploys Gitea + PostgreSQL on mad-tea-party (10.1.71.129)
+#              Role chain: common → docker-host → gitea
+#
+# USAGE:
+#   ansible-playbook -i ansible/inventory.yml ansible/playbooks/day1_deploy_gitea.yml
+#
+# SECRETS REQUIRED IN VAULT (group_vars/all/vault):
+#   vault_gitea_db_password
+# ------------------------------------------------------------------------------
+
+- name: Deploy Gitea on mad-tea-party
+  hosts: gitea_servers
+  become: true
+
+  vars:
+    gitea_db_password: "{{ vault_gitea_db_password }}"
+
+  roles:
+    - role: docker-host
+    - role: gitea

ansible/playbooks/day1_deploy_hermes.yml

@@ -0,0 +1,79 @@
+---
+# =============================================================================
+# day1_deploy_hermes.yml
+# Deploy Hermes Agent (Nous Research) on carousel-of-progress (10.1.71.131)
+#
+# FIRST-RUN WORKFLOW:
+#   1. Run this playbook:
+#        ansible-playbook playbooks/day1_deploy_hermes.yml
+#
+#   2. SSH to the host and run the setup wizard as the hermes user:
+#        ssh wed@carousel-of-progress.local.mk-labs.cloud
+#        sudo -u hermes hermes setup
+#
+#   3. Once configured, start and verify the service:
+#        sudo systemctl start hermes
+#        sudo systemctl status hermes
+#        sudo journalctl -u hermes -f
+#
+# VARIABLES:
+#   hermes_skip_browser: true   — set to skip Playwright/Chromium install
+#                                 (saves ~300MB if browser automation not needed)
+# =============================================================================
+
+- name: Deploy Hermes Agent on carousel-of-progress
+  hosts: carousel-of-progress
+  gather_facts: true
+
+  pre_tasks:
+    - name: Verify target is carousel-of-progress
+      ansible.builtin.assert:
+        that:
+          - inventory_hostname == "carousel-of-progress"
+        fail_msg: >
+          This playbook is scoped to carousel-of-progress only.
+          Got: {{ inventory_hostname }}
+
+    - name: Confirm OS is Ubuntu
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution == "Ubuntu"
+        fail_msg: >
+          This playbook requires Ubuntu. Found: {{ ansible_distribution }}.
+          (If running Fedora, swap apt tasks for dnf and adjust Playwright deps.)
+
+  roles:
+    - role: hermes
+      vars:
+        hermes_skip_browser: false   # set true to skip Chromium install
+
+  post_tasks:
+    - name: Verify hermes binary is accessible system-wide
+      ansible.builtin.command: hermes --version
+      register: hermes_version_check
+      changed_when: false
+      failed_when: hermes_version_check.rc != 0
+
+    - name: Print hermes version
+      ansible.builtin.debug:
+        msg: "{{ hermes_version_check.stdout }}"
+
+    - name: Print post-install instructions
+      ansible.builtin.debug:
+        msg:
+          - "============================================================"
+          - "Hermes installed on carousel-of-progress (10.1.71.131)"
+          - "============================================================"
+          - "Next steps:"
+          - "  1. SSH to the host:"
+          - "       ssh wed@carousel-of-progress.local.mk-labs.cloud"
+          - "  2. Run the setup wizard as the hermes user:"
+          - "       sudo -u hermes hermes setup"
+          - "  3. After config, start the service:"
+          - "       sudo systemctl start hermes"
+          - "  4. Verify:"
+          - "       sudo systemctl status hermes"
+          - "       sudo journalctl -u hermes -f"
+          - "============================================================"
+          - "Service is ENABLED but NOT STARTED — config required first."
+          - "============================================================"

ansible/playbooks/day1_deploy_honcho.yml

@@ -0,0 +1,18 @@
+---
+# ============================================================================
+# day1_deploy_honcho.yml
+# ----------------------------------------------------------------------------
+# Deploys Honcho + pgvector PostgreSQL on the `lincoln` host. Assumes day0
+# host provisioning (linux-baseline + expand_root_lv) is already complete.
+#
+# Run via:
+#   ansible-playbook -i inventory.yml playbooks/day0_provision.yml -e target=lincoln
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_honcho.yml
+# ============================================================================
+
+- name: Deploy Honcho on lincoln
+  hosts: honcho_server
+  become: true
+  gather_facts: true
+  roles:
+    - honcho

ansible/playbooks/day1_deploy_jmri.yml

@@ -0,0 +1,24 @@
+---
+# ============================================================================
+# day1_deploy_jmri.yml
+# ----------------------------------------------------------------------------
+# Deploys JMRI JmriFaceless headless server on main-street-station.
+# Applies linux-baseline first, then the jmri role.
+#
+# Usage:
+#   ansible-playbook playbooks/day1_deploy_jmri.yml
+#   ansible-playbook playbooks/day1_deploy_jmri.yml -e target=main-street-station
+#
+# Prerequisites:
+#   1. Host is in inventory under jmri_server group
+#   2. jmri_profile_id is set in host_vars/main-street-station.yml
+#   3. SSH access as 'wed' with sudo
+# ============================================================================
+
+- name: Deploy JMRI headless server
+  hosts: "{{ target | default('jmri_server') }}"
+  become: true
+  gather_facts: true
+  roles:
+    - linux-baseline
+    - jmri

ansible/playbooks/day1_deploy_nextcloud.yml

@@ -0,0 +1,91 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/day1_deploy_nextcloud.yml
+# DESCRIPTION: Deploys Nextcloud on the-grid
+#              Runs: docker-host → nextcloud
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_nextcloud.yml
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_nextcloud.yml --limit the-grid
+#
+# SECRETS REQUIRED IN VAULT (group_vars/all/vault):
+#   vault_nextcloud_db_root_password
+#   vault_nextcloud_db_password
+#   vault_nextcloud_admin_user
+#   vault_nextcloud_admin_password
+# ------------------------------------------------------------------------------
+
+- name: Deploy Nextcloud on the-grid
+  hosts: the-grid
+  become: true
+
+  vars:
+    # NFS prerequisite
+    nfs_packages:
+      - nfs-common
+
+    # Compose stack location
+    nextcloud_base_dir: /opt/docker/nextcloud
+
+    # Secrets from vault
+    nextcloud_db_root_password: "{{ vault_nextcloud_db_root_password }}"
+    nextcloud_db_password:      "{{ vault_nextcloud_db_password }}"
+    nextcloud_admin_user:       "{{ vault_nextcloud_admin_user }}"
+    nextcloud_admin_password:   "{{ vault_nextcloud_admin_password }}"
+
+  pre_tasks:
+    - name: Install NFS client
+      ansible.builtin.apt:
+        name: "{{ nfs_packages }}"
+        state: present
+        update_cache: true
+
+  roles:
+    - role: docker-host
+
+  tasks:
+    - name: Create Nextcloud directory
+      ansible.builtin.file:
+        path: "{{ nextcloud_base_dir }}"
+        state: directory
+        owner: "{{ ansible_user }}"
+        group: docker
+        mode: "0775"
+
+    - name: Deploy Compose file
+      ansible.builtin.copy:
+        src: "{{ playbook_dir }}/../../boilerplates/nextcloud/compose.yml"
+        dest: "{{ nextcloud_base_dir }}/compose.yml"
+        owner: "{{ ansible_user }}"
+        group: docker
+        mode: "0644"
+
+    - name: Deploy .env from vault
+      ansible.builtin.copy:
+        content: |
+          # Managed by Ansible — do not edit manually
+          MYSQL_ROOT_PASSWORD={{ nextcloud_db_root_password }}
+          MYSQL_PASSWORD={{ nextcloud_db_password }}
+          NEXTCLOUD_ADMIN_USER={{ nextcloud_admin_user }}
+          NEXTCLOUD_ADMIN_PASSWORD={{ nextcloud_admin_password }}
+        dest: "{{ nextcloud_base_dir }}/.env"
+        owner: "{{ ansible_user }}"
+        group: docker
+        mode: "0600"
+
+    - name: Start Nextcloud stack
+      community.docker.docker_compose_v2:
+        project_src: "{{ nextcloud_base_dir }}"
+        state: present
+
+    - name: Wait for Nextcloud to become ready
+      ansible.builtin.uri:
+        url: "http://the-grid.local.mk-labs.cloud/status.php"
+        status_code: 200
+        return_content: true
+      register: nextcloud_status
+      until: >
+        nextcloud_status.status == 200 and
+        (nextcloud_status.content | from_json).installed == true
+      retries: 20
+      delay: 15

ansible/playbooks/day1_deploy_ollama.yml

@@ -0,0 +1,35 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day1_deploy_ollama.yml
+# DESCRIPTION: Deploys Ollama with ROCm GPU acceleration on astro-orbiter.
+#              Assumes day0_baseline.yml has already run (common role complete).
+#              PCIe passthrough for the RX 5700 must be configured in Proxmox
+#              and the GPU must be visible to the VM before running this playbook.
+#
+# Pre-flight check:
+#   ssh wed@astro-orbiter 'lspci | grep -i amd'
+#   Should show the RX 5700 before proceeding.
+#
+# Usage (from ansible/ directory):
+#   ansible-playbook playbooks/day1_deploy_ollama.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Ollama with ROCm on astro-orbiter
+  hosts: astro-orbiter
+  become: true
+
+  pre_tasks:
+    - name: Verify AMD GPU is visible to the VM
+      command: lspci
+      register: lspci_output
+      changed_when: false
+
+    - name: Fail if no AMD GPU detected
+      fail:
+        msg: >
+          No AMD GPU detected via lspci. Verify PCIe passthrough is configured
+          in Proxmox and the RX 5700 is visible to the VM before proceeding.
+      when: "'AMD' not in lspci_output.stdout and 'Radeon' not in lspci_output.stdout"
+
+  roles:
+    - ollama

ansible/playbooks/day1_deploy_semaphore.yml

@@ -0,0 +1,17 @@
+---
+# ============================================================================
+# day1_deploy_semaphore.yml
+# ----------------------------------------------------------------------------
+# Deploys SemaphoreUI + PostgreSQL on the imagineering host (figment).
+# Run AFTER day0_linux_baseline.yml has been applied to the target.
+#
+# Usage:
+#   ansible-playbook -i inventory.yml playbooks/day1_deploy_semaphore.yml
+# ============================================================================
+
+- name: Deploy SemaphoreUI on imagineering
+  hosts: semaphore_server
+  become: true
+  gather_facts: true
+  roles:
+    - semaphore

ansible/playbooks/day1_deploy_traefik.yml

@@ -0,0 +1,18 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_traefik.yml
+# DESCRIPTION: Deploys Traefik reverse proxy on lightning-lane.
+#              Installs Docker and configures Traefik with Cloudflare DNS-01
+#              certificate resolution for *.local.mk-labs.cloud
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_traefik.yml
+# ------------------------------------------------------------------------------
+
+- name: Deploy Traefik reverse proxy
+  hosts: load_balancers
+  become: true
+
+  roles:
+    - docker-host
+    - traefik

ansible/playbooks/day1_docker.yml

@@ -0,0 +1,7 @@
+---
+- name: Apply common role
+  hosts: "{{ target | default('all') }}"
+  become: true
+  roles:
+    - common
+    - docker-host

ansible/playbooks/day2_install_node_exporter.yml

@@ -0,0 +1,80 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day2_install_node_exporter.yml
+# DESCRIPTION: Install and configure Prometheus Node Exporter on Linux hosts.
+#
+# Targets two groups with different firewall managers:
+#   - proxmox_nodes  : Proxmox hypervisors (Debian, firewalld not present,
+#                      uses iptables/no firewall — just open the port via UFW
+#                      if present, otherwise skip)
+#   - monitored_vms  : Ubuntu VMs managed by UFW
+#
+# After installing on new hosts, re-runs day1_deploy_monitoring.yml to refresh
+# the Prometheus scrape config is NOT needed — targets are already statically
+# defined in prometheus.yaml.j2 for the Proxmox nodes. For new VMs, add the
+# IP to the prometheus.yaml.j2 proxmox-vms job and re-run day1_deploy_monitoring.yml.
+#
+# Usage:
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml --limit proxmox_nodes
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml --limit monitored_vms
+# ------------------------------------------------------------------------------
+
+# ── Play 1: Proxmox hypervisors ───────────────────────────────────────────────
+# Proxmox runs Debian. The prometheus.prometheus.node_exporter role installs
+# a binary + systemd service without touching apt, which is what we want on
+# hypervisors (keep the package footprint clean).
+# Note: Proxmox does not run UFW. Port 9100 is open by default on VLAN 71.
+
+- name: Install Node Exporter on Proxmox hypervisors
+  hosts: proxmox_nodes
+  become: true
+
+  vars:
+    node_exporter_version: "1.9.1"
+    node_exporter_web_listen_address: "0.0.0.0:9100"
+    node_exporter_enabled_collectors:
+      - systemd
+      - processes
+      - filesystem
+      - meminfo
+      - cpu
+      - diskstats
+      - netdev
+      - loadavg
+      - uname
+
+  roles:
+    - role: prometheus.prometheus.node_exporter
+
+# ── Play 2: Ubuntu VMs ────────────────────────────────────────────────────────
+# Standard Ubuntu hosts with UFW. Same role, adds UFW allow rule for 9100.
+
+- name: Install Node Exporter on monitored VMs
+  hosts: monitored_vms
+  become: true
+
+  vars:
+    node_exporter_version: "1.9.1"
+    node_exporter_web_listen_address: "0.0.0.0:9100"
+    node_exporter_enabled_collectors:
+      - systemd
+      - processes
+      - filesystem
+      - meminfo
+      - cpu
+      - diskstats
+      - netdev
+      - loadavg
+      - uname
+
+  pre_tasks:
+    - name: Open Node Exporter port in UFW
+      community.general.ufw:
+        rule: allow
+        port: "9100"
+        proto: tcp
+        comment: "Prometheus Node Exporter"
+
+  roles:
+    - role: prometheus.prometheus.node_exporter

ansible/playbooks/deploy-fastpass-4step.yml

@@ -1,30 +0,0 @@
----
-# - name: Step 1 - Install Prerequisites
-#   hosts: fastpass
-#   become: true
-#   gather_facts: true
-#   roles:
-#     - role: kubernetes-prerequisites
-
-# - name: Step 2 - Deploy First Control Plane Node
-#   hosts: fastpass_control_plane[0]
-#   become: true
-#   gather_facts: false
-#   roles:
-#     - role: fastpass-first-control-plane
-
-- name: Step 3 - Deploy Additional Control Plane Nodes
-  hosts: fastpass_control_plane[1:]
-  become: true
-  gather_facts: true # false
-  roles:
-    - role: fastpass-additional-control-plane
-  vars:
-    cluster_name: "fastpass"
-
-# - name: Step 4 - Deploy Worker Nodes
-#   hosts: fastpass_workers
-#   become: true
-#   gather_facts: false
-#   roles:
-#     - role: fastpass-workers

ansible/playbooks/deploy-fastpass-cluster.yml

@@ -1,157 +0,0 @@
----
-# FastPass Kubernetes Cluster Deployment
-# This playbook deploys a complete Kubernetes cluster on Fedora
-
-- name: 1. Preflight checks and system preparation
-  hosts: fastpass
-  become: true
-  gather_facts: true
-  roles:
-    - role: kubernetes
-
-- name: 2. Initialize first control plane node
-  hosts: fastpass_control_plane[0]
-  become: true
-  gather_facts: false
-  roles:
-    - role: fastpass-control-plane
-
-- name: 3. Install Calico CNI
-  hosts: fastpass_control_plane[0]
-  become: false
-  gather_facts: false
-  environment:
-    KUBECONFIG: "{{ kubeconfig_path }}"
-  tasks:
-    - name: Check if Calico is already installed
-      ansible.builtin.shell: kubectl get pods -n kube-system -l k8s-app=calico-node --no-headers | wc -l
-      delegate_to: localhost
-      register: calico_check
-      ignore_errors: true
-
-    - name: Display Calico check result
-      ansible.builtin.debug:
-        msg: "Calico pods found: {{ calico_check.stdout | trim }}"
-      delegate_to: localhost
-
-    - name: Install Calico CNI
-      ansible.builtin.command: kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/{{ calico_version | default('v3.28.0') }}/manifests/calico.yaml
-      delegate_to: localhost
-      when: calico_check.stdout | trim == "0"
-      register: calico_install_result
-      ignore_errors: true
-
-    - name: Display Calico installation result
-      ansible.builtin.debug:
-        msg: "Calico install stdout: {{ calico_install_result.stdout }}"
-      delegate_to: localhost
-      when: calico_check.stdout | trim == "0"
-
-    - name: Wait for Calico node pods to be ready
-      ansible.builtin.command: kubectl wait --for=condition=ready pod -l k8s-app=calico-node -n kube-system --timeout=300s
-      delegate_to: localhost
-      when: calico_check.stdout | trim == "0"
-
-- name: 4. Wait for first control plane to be fully ready
-  hosts: fastpass_control_plane[0]
-  become: false
-  gather_facts: false
-  environment:
-    KUBECONFIG: "{{ kubeconfig_path }}"
-  tasks:
-    - name: Wait for API server to be ready on first node
-      ansible.builtin.wait_for:
-        host: "{{ inventory_hostname }}"
-        port: "{{ control_plane_port | default('6443') }}"
-        timeout: 300
-      delegate_to: localhost
-
-    - name: Wait for first control plane node to be ready
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node {{ inventory_hostname }} --timeout=300s
-      delegate_to: localhost
-
-    - name: Verify control plane status
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
-      delegate_to: localhost
-      register: node_status
-
-    - name: Display cluster status
-      ansible.builtin.debug:
-        msg: "{{ node_status.stdout_lines }}"
-
-- name: 5. Join additional control plane nodes
-  hosts: fastpass_control_plane[1:]
-  become: true
-  gather_facts: false
-  roles:
-    - role: fastpass-control-plane-join
-
-- name: 6. Wait for all control plane nodes to be ready
-  hosts: fastpass_control_plane[0]
-  become: false
-  gather_facts: false
-  environment:
-    KUBECONFIG: "{{ kubeconfig_path }}"
-  tasks:
-    - name: Wait for all control plane nodes to be ready
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --selector=node-role.kubernetes.io/control-plane --timeout=600s
-      delegate_to: localhost
-
-    - name: Display all control plane nodes
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes --selector=node-role.kubernetes.io/control-plane -o wide
-      delegate_to: localhost
-      register: control_plane_status
-
-    - name: Show control plane status
-      ansible.builtin.debug:
-        msg: "{{ control_plane_status.stdout_lines }}"
-
-- name: 7. Join worker nodes
-  hosts: fastpass_workers
-  become: true
-  gather_facts: false
-  roles:
-    - role: fastpass-workers
-
-- name: 8. Final cluster validation
-  hosts: fastpass_control_plane[0]
-  become: false
-  gather_facts: false
-  environment:
-    KUBECONFIG: "{{ kubeconfig_path }}"
-  tasks:
-    - name: Wait for all nodes to be ready
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} wait --for=condition=ready node --all --timeout=300s
-      delegate_to: localhost
-
-    - name: Verify all pods are running
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get pods --all-namespaces
-      delegate_to: localhost
-      register: pod_status
-
-    - name: Display final cluster status
-      ansible.builtin.debug:
-        msg: |
-          ========================================
-          FastPass Kubernetes Cluster Status
-          ========================================
-          {{ pod_status.stdout }}
-          ========================================
-
-    - name: Show final node status
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} get nodes -o wide
-      delegate_to: localhost
-      register: final_node_status
-
-    - name: Display final node status
-      ansible.builtin.debug:
-        msg: "{{ final_node_status.stdout_lines }}"
-
-    - name: Test DNS-based control plane endpoint
-      ansible.builtin.command: kubectl --kubeconfig={{ kubeconfig_path }} cluster-info
-      delegate_to: localhost
-      register: cluster_info
-
-    - name: Display cluster info
-      ansible.builtin.debug:
-        msg: "{{ cluster_info.stdout_lines }}" 

ansible/playbooks/deploy-haproxy-cloudflare.yml

@@ -1,177 +0,0 @@
----
-# ansible/playbooks/deploy-haproxy-cloudflare.yml
-
-- name: Deploy HAProxy with Cloudflare DNS certificates
-  hosts: lightning-lane
-  become: true
-
-  vars:
-    # Certbot Cloudflare configuration
-    haproxy_certbot_enable: true
-    haproxy_certbot_challenge_method: "dns-cloudflare"
-    haproxy_certbot_email: "ryan@mk-labs.cloud"
-    haproxy_certbot_staging: false  # Set to true for testing
-    haproxy_certbot_cloudflare_api_token: "{{ vault_cloudflare_api_token }}"
-
-    # Request wildcard certificate
-    haproxy_certbot_domains:
-      - domain: "*.local.mk-labs.cloud"
-        include_base: true  # Also include local.mk-labs.cloud
-
-    # HAProxy Stats
-    haproxy_stats_password: "{{ vault_haproxy_stats_password }}"
-
-    # Frontend configuration
-    haproxy_frontends:
-      - name: https_front
-        bind: "*:443 ssl crt {{ haproxy_ssl_cert_dir }}/live crt {{ haproxy_ssl_default_crt }} alpn h2,http/1.1"
-        mode: http
-        options:
-          - "http-server-close"
-          - "forwardfor"
-        acls:
-          - "netbox hdr(host) -i fire-station.local.mk-labs.cloud"
-          - "wordpress hdr(host) -i be-our-guest.local.mk-labs.cloud"
-          - "plane hdr(host) -i people-mover.local.mk-labs.cloud"
-          - "minecraft hdr(host) -i arcade.local.mk-labs.cloud"
-        use_backends:
-          - "netbox_back if netbox"
-          - "wordpress_back if wordpress"
-          - "plane_back if plane"
-          - "minecraft_back if minecraft"
-
-    # Backend configuration
-    haproxy_backends:
-      - name: netbox_back
-        mode: http
-        balance: roundrobin
-        options:
-          - "httpchk GET /api/"
-        servers:
-          - name: fire-station
-            address: 10.1.71.102:8000
-            check: true
-
-      - name: wordpress_back
-        mode: http
-        balance: roundrobin
-        servers:
-          - name: be-our-guest
-            address: 10.1.71.101:80
-            check: true
-
-      - name: plane_back
-        mode: http
-        balance: roundrobin
-        servers:
-          - name: people-mover
-            address: 10.1.71.112:8080
-            check: true
-
-      - name: minecraft_back
-        mode: http
-        balance: roundrobin
-        servers:
-          - name: arcade
-            address: 10.1.71.111:25565
-            check: true
-
-    # TCP services
-    haproxy_tcp_services:
-      - name: postgres
-        frontend_port: 5432
-        backend_port: 5432
-        balance: leastconn
-        timeout_client: 1h
-        timeout_server: 1h
-        servers:
-          - name: netbox-db
-            address: 10.1.71.102
-            check: true
-
-      - name: ssh_jump
-        frontend_port: 2222
-        backend_port: 22
-        balance: source
-        servers:
-          - name: main-street-usa
-            address: 10.1.71.11
-            check: true
-          - name: tomorrowland
-            address: 10.1.71.12
-            check: true
-          - name: fantasyland
-            address: 10.1.71.13
-            check: true
-
-      - name: minecraft_java
-        frontend_port: 25565
-        backend_port: 25565
-        balance: roundrobin
-        servers:
-          - name: arcade
-            address: 10.1.71.111
-            check: true
-
-    # Firewall configuration
-    haproxy_firewall_allowed_ports:
-      - 80/tcp
-      - 443/tcp
-      - 2222/tcp
-      - 5432/tcp
-      - 8404/tcp
-      - 25565/tcp
-
-  pre_tasks:
-    - name: Ensure required groups exist
-      ansible.builtin.group:
-        name: "{{ item }}"
-        state: present
-      loop:
-        - haproxy
-
-  roles:
-    - haproxy
-
-  post_tasks:
-    - name: Wait for HAProxy to be ready
-      ansible.builtin.wait_for:
-        host: "{{ ansible_default_ipv4.address }}"
-        port: 443
-        timeout: 60
-
-    - name: Display deployment summary
-      ansible.builtin.debug:
-        msg: |
-          ╔════════════════════════════════════════════════════════════╗
-          ║  HAProxy Deployment Complete - lightning-lane              ║
-          ╚════════════════════════════════════════════════════════════╝
-
-          Stats Interface: http://{{ ansible_default_ipv4.address }}:8404/stats
-          Username: {{ haproxy_stats_username }}
-
-          HTTPS Services:
-          {% for frontend in haproxy_frontends %}
-          {% if frontend.acls is defined %}
-          {% for acl in frontend.acls %}
-          - {{ acl.split()[1] | regex_replace('hdr\\(host\\)', '') | regex_replace('-i', '') | trim }}
-          {% endfor %}
-          {% endif %}
-          {% endfor %}
-
-          TCP Services:
-          {% for tcp in haproxy_tcp_services %}
-          - {{ tcp.name }}: {{ ansible_default_ipv4.address }}:{{ tcp.frontend_port }}
-          {% endfor %}
-
-          Certificates:
-          {% for domain in haproxy_certbot_domains %}
-          - {{ domain.domain }}{% if domain.include_base | default(false) %} + base domain{% endif %}
-
-          {% endfor %}
-
-          Next steps:
-          1. Verify certificate: certbot certificates
-          2. Test renewal: certbot renew --dry-run
-          3. Check HAProxy stats interface
-          4. Test HTTPS endpoints

ansible/playbooks/deploy_k8s.yml

@@ -1,17 +0,0 @@
-# ------------------------------------------------------------------------------
-# FILE: deploy_k8s.yml
-# ------------------------------------------------------------------------------
-- name: 1. Prepare all nodes for Kubernetes
-  hosts: fastpass
-  roles:
-    - role: kubernetes
-
-- name: 2. Initialize and configure the control plane
-  hosts: fastpass_control_plane
-  roles:
-    - role: fastpass-control-plane
-
-- name: 3. Join worker nodes to the cluster
-  hosts: fastpass_workers
-  roles:
-    - role: fastpass-workers

ansible/playbooks/deploy_minecraft.yml

@@ -1,22 +0,0 @@
----
-# - name: Install additional packages
-#   hosts: papermc_server
-#   become: true
-#   tasks:
-#     - name: Install python-apt packages
-#       ansible.builtin.package:
-#         name: "libapt-pkg"
-#         state: latest
-#         update_cache: true
-
-- name: 1. Deploy Paper Minecraft server
-  hosts: papermc_server
-  roles:
-
-  vars:
-    user:
-      home_dir: /opt/minecraft
-      name: wed
-  roles:
-    - role: apigban.papermc_role
-      become: yes

ansible/playbooks/deploy_step_ca.yml

@@ -0,0 +1,29 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/deploy_step_ca.yml
+# DESCRIPTION: Deploys Smallstep step-ca SSH Certificate Authority on turnstile.
+#              Installs Docker and configures step-ca with SSH certificate support.
+#
+# PREREQUISITES:
+#   - VM provisioned via Terraform
+#   - DNS record for turnstile.local.mk-labs.cloud on monorail
+#   - Authentik OIDC application created (for post-init provisioner setup)
+#
+# USAGE:
+#   ansible-playbook -i inventory.yml playbooks/deploy_step_ca.yml
+#
+# POST-DEPLOY:
+#   1. Note the CA fingerprint from the init output
+#   2. Add the OIDC provisioner (see docs/guides/step-ca-setup.md)
+#   3. Deploy Traefik route via update_traefik_routes.yml
+#   4. Bootstrap client workstations with: step ca bootstrap
+# ------------------------------------------------------------------------------
+
+- name: Deploy step-ca SSH Certificate Authority
+  hosts: step_ca_server
+  become: true
+
+  roles:
+    - common
+    - docker-host
+    - step-ca

ansible/playbooks/enroll_step_ca_client.yml

@@ -0,0 +1,7 @@
+---
+- name: Enroll host as step-ca SSH client
+  hosts: "{{ target | default('all') }}"
+  become: true
+  tasks:
+    - name: Include step-ca client enrollment
+      ansible.builtin.include_tasks: roles/common/tasks/step_ca_client.yml

ansible/playbooks/examples/multi-cluster-kubeconfig.yml

@@ -1,41 +0,0 @@
----
-# Example playbook showing how to use the modular kubeconfig management
-# across multiple clusters in your homelab
-
-- name: Setup kubeconfig for FastPass cluster
-  hosts: fastpass_control_plane[0]
-  gather_facts: true
-  roles:
-    - role: kubeconfig-manager
-      vars:
-        cluster_name: "fastpass"
-
-- name: Setup kubeconfig for Hub cluster
-  hosts: hub_cluster
-  gather_facts: true
-  roles:
-    - role: kubeconfig-manager
-      vars:
-        cluster_name: "hub"
-
-- name: Setup kubeconfig for Internal cluster
-  hosts: internal_cluster[0]
-  gather_facts: true
-  roles:
-    - role: kubeconfig-manager
-      vars:
-        cluster_name: "internal"
-
-# Alternative approach using the generic cluster-kubeconfig role
-- name: Setup kubeconfig for any cluster
-  hosts: "{{ target_cluster_hosts }}"
-  gather_facts: true
-  roles:
-    - role: cluster-kubeconfig
-      vars:
-        cluster_name: "{{ target_cluster_name }}"
-
-# Usage examples:
-# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml
-# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml --limit fastpass_control_plane[0]
-# ansible-playbook -i inventory.yml examples/multi-cluster-kubeconfig.yml -e target_cluster_hosts=hub_cluster -e target_cluster_name=hub

ansible/playbooks/examples/setup-fastpass-network.yml

@@ -1,60 +0,0 @@
----
-# Example: Setup network infrastructure for FastPass cluster
-# This demonstrates the modular approach for DNS and load balancer setup
-
-- name: Setup FastPass Cluster Network Infrastructure
-  hosts: fastpass_control_plane[0]
-  gather_facts: true
-  vars:
-    cluster_name: "fastpass"
-    cluster_endpoint: "{{ control_plane_endpoint }}"
-    cluster_vip: "{{ ansible_default_ipv4.address }}"
-    control_plane_nodes: "{{ groups['fastpass_control_plane'] }}"
-  
-  tasks:
-    - name: Display cluster configuration
-      ansible.builtin.debug:
-        msg: |
-          Setting up network for FastPass cluster:
-          - Cluster Name: {{ cluster_name }}
-          - Endpoint: {{ cluster_endpoint }}
-          - VIP: {{ cluster_vip }}
-          - Control Plane Nodes: {{ control_plane_nodes | join(', ') }}
-
-    - name: Setup cluster network infrastructure
-      ansible.builtin.include_role:
-        name: cluster-network-setup
-      vars:
-        cluster_name: "{{ cluster_name }}"
-        cluster_endpoint: "{{ cluster_endpoint }}"
-        cluster_vip: "{{ cluster_vip }}"
-        control_plane_nodes: "{{ control_plane_nodes }}"
-
-# Alternative approach using task file directly
-- name: Alternative - Use Technitium DNS task directly
-  hosts: localhost
-  gather_facts: false
-  vars:
-    cluster_endpoint: "{{ hostvars[groups['fastpass_control_plane'][0]]['control_plane_endpoint'] }}"
-    cluster_vip: "{{ hostvars[groups['fastpass_control_plane'][0]]['ansible_default_ipv4']['address'] }}"
-  
-  tasks:
-    - name: Create DNS entry using task file
-      ansible.builtin.include_tasks: ../tasks/add_technitium_dns_entry.yml
-      vars:
-        dns_record_name: "{{ cluster_endpoint.split('.')[0] }}"
-        dns_zone: "{{ base_domain }}"
-        dns_ip_address: "{{ cluster_vip }}"
-        dns_record_type: "A"
-        dns_ttl: 360
-        dns_create_ptr: true
-        dns_debug: true
-      when: use_task_approach | default(false)
-
-# Usage examples:
-# 
-# Use modular approach (recommended):
-# ansible-playbook -i inventory.yml playbooks/examples/setup-fastpass-network.yml
-#
-# Use task file approach:
-# ansible-playbook -i inventory.yml playbooks/examples/setup-fastpass-network.yml -e use_task_approach=true

ansible/playbooks/idm-servers.yml

@@ -1,10 +0,0 @@
----
-- name: Playbook to configure IPA server
-  hosts: ipaserver
-  become: true
-  vars_files:
-    - idm-vault.yml
-
-  roles:
-    - role: freeipa.ansible_freeipa.ipaserver
-      state: present

ansible/playbooks/install_talosctl.yml

@@ -0,0 +1,15 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: playbooks/install_talosctl.yml
+# DESCRIPTION: Install talosctl on city-hall for managing the fastpass cluster.
+# USAGE:
+#   cd ansible
+#   ansible-playbook -i inventory.yml playbooks/install_talosctl.yml
+# ------------------------------------------------------------------------------
+
+- name: Install talosctl
+  hosts: talos_control
+  become: true
+
+  roles:
+    - talosctl

ansible/playbooks/reset-fastpass-cluster.yml

@@ -1,115 +0,0 @@
----
-- name: Reset FastPass Kubernetes Cluster
-  hosts: fastpass
-  become: true
-  gather_facts: false
-  tasks:
-    - name: Stop and disable kubelet service
-      ansible.builtin.systemd:
-        name: kubelet
-        state: stopped
-        enabled: false
-      ignore_errors: true
-
-    - name: Stop and disable containerd service
-      ansible.builtin.systemd:
-        name: containerd
-        state: stopped
-        enabled: false
-      ignore_errors: true
-
-    - name: Remove Kubernetes packages
-      ansible.builtin.dnf:
-        name:
-          - kubelet
-          - kubeadm
-          - kubectl
-          - kubernetes-cni
-          - containernetworking-plugins
-        state: absent
-      ignore_errors: true
-
-    - name: Remove containerd
-      ansible.builtin.dnf:
-        name: containerd
-        state: absent
-      ignore_errors: true
-
-    - name: Remove Docker repository
-      ansible.builtin.file:
-        path: /etc/yum.repos.d/docker-ce.repo
-        state: absent
-      ignore_errors: true
-
-    - name: Remove Kubernetes repository
-      ansible.builtin.file:
-        path: /etc/yum.repos.d/kubernetes.repo
-        state: absent
-      ignore_errors: true
-
-    - name: Remove Kubernetes directories
-      ansible.builtin.file:
-        path: "{{ item }}"
-        state: absent
-      loop:
-        - /etc/kubernetes
-        - /var/lib/kubelet
-        - /var/lib/etcd
-        - /etc/cni/net.d
-        - /opt/cni/bin
-        - /var/lib/containerd
-        - /etc/containerd
-      ignore_errors: true
-
-    - name: Remove CNI plugins
-      ansible.builtin.file:
-        path: /opt/cni
-        state: absent
-      ignore_errors: true
-
-    - name: Remove iptables rules
-      ansible.builtin.shell: |
-        iptables -F
-        iptables -t nat -F
-        iptables -t mangle -F
-        iptables -X
-      ignore_errors: true
-
-    - name: Remove firewall Kubernetes service
-      ansible.builtin.file:
-        path: /etc/firewalld/services/kubernetes.xml
-        state: absent
-      ignore_errors: true
-
-    - name: Remove firewall rules for Kubernetes
-      ansible.builtin.shell: |
-        firewall-cmd --permanent --remove-service=kubernetes || true
-        firewall-cmd --reload || true
-      ignore_errors: true
-
-    - name: Reset network interfaces
-      ansible.builtin.shell: |
-        ip link delete cni0 || true
-        ip link delete flannel.1 || true
-        ip link delete cali* || true
-      ignore_errors: true
-
-    - name: Clean up systemd drop-in files
-      ansible.builtin.file:
-        path: /usr/lib/systemd/system/kubelet.service.d
-        state: absent
-      ignore_errors: true
-
-    - name: Reset hostname to original
-      ansible.builtin.hostname:
-        name: "{{ inventory_hostname }}"
-
-    - name: Clean package cache
-      ansible.builtin.dnf:
-        clean: all
-      ignore_errors: true
-
-    - name: Reboot system
-      ansible.builtin.reboot:
-        reboot_timeout: 300
-

ansible/playbooks/roles/cluster-kubeconfig/tasks/main.yml

@@ -1,12 +0,0 @@
----
-# role: cluster-kubeconfig
-# description: Generic role for any Kubernetes cluster kubeconfig management
-# author: mk-labs
-# version: 1.0.0
-
-- name: Setup kubeconfig for {{ cluster_name }} cluster
-  ansible.builtin.include_role:
-    name: kubeconfig-manager
-  vars:
-    cluster_name: "{{ cluster_name }}"
-    kubeconfig_source_path: "{{ kubeconfig_source_path | default('/etc/kubernetes/admin.conf') }}"

ansible/playbooks/roles/cluster-network-setup/tasks/main.yml

@@ -1,48 +0,0 @@
----
-# role: cluster-network-setup
-# description: Combined DNS and Load Balancer setup for Kubernetes clusters
-# author: mk-labs
-# version: 1.0.0
-
-- name: Setup DNS entry for cluster
-  ansible.builtin.include_role:
-    name: dns-manager
-  vars:
-    cluster_endpoint: "{{ cluster_endpoint }}"
-    cluster_vip: "{{ cluster_vip }}"
-
-- name: Setup Traefik load balancer for cluster
-  ansible.builtin.include_role:
-    name: traefik-manager
-  vars:
-    cluster_name: "{{ cluster_name }}"
-    cluster_endpoint: "{{ cluster_endpoint }}"
-    control_plane_nodes: "{{ control_plane_nodes }}"
-  when: traefik_enabled | default(true)
-
-- name: Wait for DNS propagation
-  ansible.builtin.wait_for:
-    timeout: 30
-  delegate_to: localhost
-
-- name: Test cluster endpoint connectivity
-  ansible.builtin.wait_for:
-    host: "{{ cluster_endpoint }}"
-    port: "{{ cluster_api_port | default(6443) }}"
-    timeout: 60
-  delegate_to: localhost
-  register: connectivity_test
-  failed_when: false
-
-- name: Display network setup results
-  ansible.builtin.debug:
-    msg: |
-      🌐 Network Setup Complete for {{ cluster_name }}:
-      
-      DNS Entry: {{ cluster_endpoint }} → {{ cluster_vip }}
-      Load Balancer: {{ 'Configured' if traefik_enabled | default(true) else 'Skipped' }}
-      Connectivity: {{ 'Success' if connectivity_test.failed == false else 'Failed - Check firewall/network' }}
-      
-      Next steps:
-      1. Verify: kubectl --kubeconfig ~/.kube/config-{{ cluster_name }} cluster-info
-      2. Switch context: kubectl config use-context {{ cluster_name }}-admin

ansible/playbooks/roles/common/files/unbound.conf

@@ -1,4 +0,0 @@
-[Resolve]
-DNS=127.0.0.1
-DNSSEC=yes
-DNSStubListener=no

ansible/playbooks/roles/containerd/defaults/main.yml

@@ -1,3 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-# defaults file for containerd

ansible/playbooks/roles/containerd/handlers/main.yml

@@ -1,3 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-# handlers file for containerd

ansible/playbooks/roles/containerd/tasks/main.yml

@@ -1,74 +0,0 @@
----
-# tasks file for containerd
-- name: Install containerd dependencies
-  become: true
-  ansible.builtin.package:
-    name: "{{ item }}"
-    state: present
-  loop:
-    "{{ containerd_dependencies }}"
-
-- name: Install via apt
-  become: true
-  when: ansible_os_family == "Debian"
-  block:
-    - name: Add repo using key from URL (apt)
-      ansible.builtin.deb822_repository:
-        name: docker
-        types: deb
-        uris: https://download.docker.com/linux/ubuntu
-        suites: "{{ ansible_distribution_release }}"
-        components: stable
-        architectures: amd64
-        signed_by: https://download.docker.com/linux/ubuntu/gpg
-
-    - name: Update apt cache
-      ansible.builtin.apt:
-        update_cache: true
-
-- name: Install via dnf
-  become: true
-  when: ansible_os_family == "RedHat"
-  block:
-    - name: Add repo using key from URL (dnf)
-      ansible.builtin.yum_repository:
-        name: docker
-        description: "Docker repository"
-        baseurl: https://download.docker.com/linux/ubuntu
-        gpgcheck: true
-        gpgkey: https://download.docker.com/linux/ubuntu/gpg
-
-    - name: Update dnf cache
-      ansible.builtin.dnf:
-        update_cache: true
-
-- name: Install containerd
-  become: true
-  ansible.builtin.package:
-    name: containerd.io
-    state: present
-
-- name: Create containerd config directory
-  ansible.builtin.file:
-    path: /etc/containerd
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-
-- name: Check if containerd config file exists
-  ansible.builtin.stat:
-    path: /etc/containerd/config.toml
-  register: containerd_config_file
-
-- name: Generate default containerd config and enable SystemdCgroup
-  when: containerd_config_file.stat.exists == false
-  ansible.builtin.shell: |
-    containerd config default > /etc/containerd/config.toml
-    sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
-
-- name: Restart and enable containerd service
-  ansible.builtin.systemd:
-    name: containerd
-    state: restarted
-    enabled: true

ansible/playbooks/roles/containerd/tests/test.yml

@@ -1,6 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-- hosts: localhost
-  remote_user: root
-  roles:
-    - containerd

ansible/playbooks/roles/containerd/vars/main.yml

@@ -1,3 +0,0 @@
-#SPDX-License-Identifier: MIT-0
----
-# vars file for containerd

ansible/playbooks/roles/fastpass-additional-control-plane/README.md

@@ -1,38 +0,0 @@
-Role Name
-=========
-
-A brief description of the role goes here.
-
-Requirements
-------------
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-Role Variables
---------------
-
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
-
-Dependencies
-------------
-
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
-
-Example Playbook
-----------------
-
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
-
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
-
-License
--------
-
-BSD
-
-Author Information
-------------------
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).

ansible/playbooks/roles/fastpass-additional-control-plane/defaults/main.yml

@@ -1,22 +0,0 @@
----
-# FastPass Additional Control Plane Role Defaults
-
-# Kubernetes services for control plane
-kubernetes_services_control_plane:
-  - kubernetes_API
-  - etcd
-  - kubelet
-  - kube-scheduler
-  - kube-controller-manager
-
-# Join token configuration
-join_token_ttl: "24h"
-certificate_key_ttl: "2h"
-
-# Default cluster configuration
-pod_network_cidr: "10.244.0.0/16"
-service_cidr: "10.96.0.0/12"
-
-# Kubelet configuration
-kubelet_cgroup_driver: "systemd"
-container_runtime_endpoint: "unix:///run/containerd/containerd.sock"

ansible/playbooks/roles/fastpass-additional-control-plane/handlers/main.yml

@@ -1,2 +0,0 @@
----
-# handlers file for fastpass-additional-control-plane

ansible/playbooks/roles/fastpass-additional-control-plane/meta/main.yml

@@ -1,33 +0,0 @@
----
-galaxy_info:
-  author: Ryan Blundon
-  description: FastPass Additional Control Plane - Deploy additional control plane nodes to existing FastPass Kubernetes cluster
-  company: Homelab
-
-  license: MIT
-
-  min_ansible_version: "2.9"
-
-  platforms:
-    - name: Ubuntu
-      versions:
-        - focal
-        - jammy
-    - name: Debian
-      versions:
-        - bullseye
-        - bookworm
-
-  galaxy_tags:
-    - kubernetes
-    - k8s
-    - controlplane
-    - cluster
-    - fastpass
-    - kubeadm
-
-dependencies:
-  - role: dns-manager
-    when: cluster_name is defined
-  - role: kubeconfig-manager
-    when: cluster_name is defined

ansible/playbooks/roles/fastpass-additional-control-plane/tasks/main.yml

@@ -1,29 +0,0 @@
----
-# role: fastpass-additional-control-plane
-# description: FastPass Additional Control Plane - Deploy additional control plane nodes to existing FastPass Kubernetes cluster
-# author: Ryan Blundon
-# version: 1.0.0
-# date: 2025-10-05
-
-# This role joins additional nodes to an existing Kubernetes cluster as control plane nodes
-# It follows the same patterns as fastpass-first-control-plane but uses kubeadm join instead of kubeadm init
-
-- name: Display role information
-  ansible.builtin.debug:
-    msg: "Starting FastPass Additional Control Plane deployment for {{ inventory_hostname }}"
-
-- name: Setup DNS record for cluster
-  ansible.builtin.include_role:
-    name: dns-manager
-  vars:
-    host_name: "{{ cluster_name }}"
-
-- name: Open services for control plane
-  become: true
-  when: ansible_os_family == "Debian"
-  block:
-    - name: Open firewall ports for control plane
-      community.general.ufw:
-        rule: allow
-        name: "{{ item }}"
-      loop: "{{ kubernetes_services_control_plane }}"

ansible/playbooks/roles/fastpass-additional-control-plane/tests/inventory

@@ -1,3 +0,0 @@
-#SPDX-License-Identifier: MIT-0
-localhost
-